Libvirt Security Notice: LSN-2013-0007
Crash listing inactive domains in Xen driver
Lifecycle
| Reported on: |
20130805 |
| Published on: |
20130805 |
| Fixed on: |
20130805 |
Credits
See also
Description
The legacy Xen driver code for listing inactive domains
would start populating an array at index -1. This causes memory
corruption leading to a crash of libvirtd
Impact
An unprivileged user can crash libvirtd by requesting a
list of inactive domains on a Xen host
Workaround
Prevent untrusted users from accessing libvirtd
Affected product: libvirt
Alternative formats:
[xml] [text]