<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2014-0004</id>

  <summary>Querying blkiotune after disk hotplug can lead to libvirtd crash</summary>

  <description>
<![CDATA[The qemu implementation of virDomainGetBlockIoTune computed
an index into the array of disks for the live definition, then used it
as the index into the array of disks for the persistent definition.
If management had hot-plugged disks to the live definition, the two
arrays are not necessarily the same length, and this could result in
the persistent definition dereferencing an out-of-bounds pointer.]]>
  </description>

  <impact>
<![CDATA[A read-only client can cause a denial of service attack
against a privileged client if the out-of-bounds dereference causes
libvirtd to crash, or possibly gain read access to sensitive
information residing in the heap.]]>
  </impact>

  <workaround>
<![CDATA[The out-of-bounds access is only possible on domains that
have had disks hot-plugged or removed from the live image without also
updating the persistent definition to match; keeping the two
definitions matched or using only transient domains will avoid the
problem. Denying access to the readonly libvirt socket will avoid the
potential for a denial of service attack, but will not prevent the
out-of-bounds access from causing a crash for a privileged client,
although such a crash is no longer a security problem.]]>
  </workaround>

  <credits>
    <reporter>
      <name>Luyao Huang</name>
      <email>lhuang@redhat.com</email>
    </reporter>
    <patcher>
      <name>Peter Krempa</name>
      <email>pkrempa@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20140911</reported>
    <published>20140917</published>
    <fixed>20140917</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2014-3633"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v0.9.8</tag>
      <tag state="vulnerable">v0.9.9</tag>
      <tag state="vulnerable">v0.9.10</tag>
      <tag state="vulnerable">v0.9.11</tag>
      <tag state="vulnerable">v0.9.12</tag>
      <tag state="vulnerable">v0.9.13</tag>
      <tag state="vulnerable">v0.10.0</tag>
      <tag state="vulnerable">v0.10.1</tag>
      <tag state="vulnerable">v0.10.2</tag>
      <tag state="vulnerable">v1.0.0</tag>
      <tag state="vulnerable">v1.0.1</tag>
      <tag state="vulnerable">v1.0.2</tag>
      <tag state="vulnerable">v1.0.3</tag>
      <tag state="vulnerable">v1.0.4</tag>
      <tag state="vulnerable">v1.0.5</tag>
      <tag state="vulnerable">v1.0.6</tag>
      <tag state="vulnerable">v1.1.0</tag>
      <tag state="vulnerable">v1.1.1</tag>
      <tag state="vulnerable">v1.1.2</tag>
      <tag state="vulnerable">v1.1.3</tag>
      <tag state="vulnerable">v1.1.4</tag>
      <tag state="vulnerable">v1.2.0</tag>
      <tag state="vulnerable">v1.2.1</tag>
      <tag state="vulnerable">v1.2.2</tag>
      <tag state="vulnerable">v1.2.3</tag>
      <tag state="vulnerable">v1.2.4</tag>
      <tag state="vulnerable">v1.2.5</tag>
      <tag state="vulnerable">v1.2.6</tag>
      <tag state="vulnerable">v1.2.7</tag>
      <tag state="vulnerable">v1.2.8</tag>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <tag state="fixed">v1.2.9</tag>
      <change state="fixed">3e745e8f775dfe6f64f18b5c2fe4791b35d3546b</change>
    </branch>
    <branch>
      <name>v0.9.11-maint</name>
      <tag state="vulnerable">v0.9.11.1</tag>
      <tag state="vulnerable">v0.9.11.2</tag>
      <tag state="vulnerable">v0.9.11.3</tag>
      <tag state="vulnerable">v0.9.11.4</tag>
      <tag state="vulnerable">v0.9.11.5</tag>
      <tag state="vulnerable">v0.9.11.6</tag>
      <tag state="vulnerable">v0.9.11.7</tag>
      <tag state="vulnerable">v0.9.11.8</tag>
      <tag state="vulnerable">v0.9.11.9</tag>
      <tag state="vulnerable">v0.9.11.10</tag>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
    </branch>
    <branch>
      <name>v0.9.12-maint</name>
      <tag state="vulnerable">v0.9.12.1</tag>
      <tag state="vulnerable">v0.9.12.2</tag>
      <tag state="vulnerable">v0.9.12.3</tag>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">750280023cc0896b05f86e292857ceef5eee3a72</change>
    </branch>
    <branch>
      <name>v0.10.2-maint</name>
      <tag state="vulnerable">v0.10.2.1</tag>
      <tag state="vulnerable">v0.10.2.2</tag>
      <tag state="vulnerable">v0.10.2.3</tag>
      <tag state="vulnerable">v0.10.2.4</tag>
      <tag state="vulnerable">v0.10.2.5</tag>
      <tag state="vulnerable">v0.10.2.6</tag>
      <tag state="vulnerable">v0.10.2.7</tag>
      <tag state="vulnerable">v0.10.2.8</tag>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">0fa54204f264e3d39387f5762f810d31cce770b2</change>
    </branch>
    <branch>
      <name>v1.0.0-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
    </branch>
    <branch>
      <name>v1.0.1-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
    </branch>
    <branch>
      <name>v1.0.2-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">d30fea03a545a2d9f5f228cd3292484ce7850256</change>
    </branch>
    <branch>
      <name>v1.0.3-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">35a802639d713054503f7243e39be0503fe19ec3</change>
    </branch>
    <branch>
      <name>v1.0.4-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">a45c8466fa3531d35728575a1facc0406f97079a</change>
    </branch>
    <branch>
      <name>v1.0.5-maint</name>
      <tag state="vulnerable">v1.0.5.1</tag>
      <tag state="vulnerable">v1.0.5.2</tag>
      <tag state="vulnerable">v1.0.5.3</tag>
      <tag state="vulnerable">v1.0.5.4</tag>
      <tag state="vulnerable">v1.0.5.5</tag>
      <tag state="vulnerable">v1.0.5.6</tag>
      <tag state="vulnerable">v1.0.5.7</tag>
      <tag state="vulnerable">v1.0.5.8</tag>
      <tag state="vulnerable">v1.0.5.9</tag>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">cc05c6d5d2f7a577a1a365fbc5451fb6b5f57445</change>
    </branch>
    <branch>
      <name>v1.0.6-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">cc19d1c08f49acdcfd5eb0e26561ea88e800f177</change>
    </branch>
    <branch>
      <name>v1.1.0-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">dd8a348e4747a59c60991f3b41567ab0a1dcca0e</change>
    </branch>
    <branch>
      <name>v1.1.1-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">ed071fee073bc5a439ec64f0e501d5f90c41dec5</change>
    </branch>
    <branch>
      <name>v1.1.2-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">d4360edd1ca88cb1f144bf77f7df23ebf1f90632</change>
    </branch>
    <branch>
      <name>v1.1.3-maint</name>
      <tag state="vulnerable">v1.1.3.1</tag>
      <tag state="vulnerable">v1.1.3.2</tag>
      <tag state="vulnerable">v1.1.3.3</tag>
      <tag state="vulnerable">v1.1.3.4</tag>
      <tag state="vulnerable">v1.1.3.5</tag>
      <tag state="vulnerable">v1.1.3.6</tag>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <tag state="fixed">v1.1.3.7</tag>
      <change state="fixed">eefe2e013820a76dfe5132431db72aade911eeab</change>
    </branch>
    <branch>
      <name>v1.1.4-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">92430a6942fc0f4dceea4957f688430f093676ab</change>
    </branch>
    <branch>
      <name>v1.2.0-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">e8f6971e3f29a7392224d7056b05b2acf133e58d</change>
    </branch>
    <branch>
      <name>v1.2.1-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">fdde9d6a1b8a559f5fa18a68cc8e8a35354b3ae9</change>
    </branch>
    <branch>
      <name>v1.2.2-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">111855e82429249ccd98f9ed0c8c72116e241959</change>
    </branch>
    <branch>
      <name>v1.2.3-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">81edcbb3ca1061d5b54945a7e1e9e2e03891307b</change>
    </branch>
    <branch>
      <name>v1.2.4-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">8a07faf3377c4b1e9f4ded59882f305426d02e6c</change>
    </branch>
    <branch>
      <name>v1.2.5-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">7156bd0ce2dc92231c393fc7bd493e7aa383d966</change>
    </branch>
    <branch>
      <name>v1.2.6-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">4e701c06c54ec007041e20e5ef085711f38a0266</change>
    </branch>
    <branch>
      <name>v1.2.7-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">cf7a69bc08e79c254f1accd939f4746ca94fe7e7</change>
    </branch>
    <branch>
      <name>v1.2.8-maint</name>
      <change state="vulnerable">eca96694a7f992be633d48d5ca03cedc9bbc3c9a</change>
      <change state="fixed">6bdf14150e99ca8921a4017bb9502325e200815b</change>
    </branch>
  </product>

</security-notice>
