Libvirt Security Notice: LSN-2014-0005

virConnectListAllDomains can deadlock

Lifecycle

Credits

See also

• CVE-2014-3657

Description

The common implementation of virConnectListAllDomains used an early return statement instead of jumping to a cleanup label when the API was used with a NULL list parameter to merely obtain a count of domains that match the filters. Because it missed the cleanup label, this left the list of domains locked and prevented all further APIs from accessing the list.

Impact

A read-only client can cause a denial of service attack against a privileged client by passing a NULL parameter to force the deadlock condition.

Workaround

As long as all callers pass a non-NULL argument to virConnectListAllDomains to collect an actual list rather than just a count, the deadlock will not occur (this mode of operation is the only mode used by virsh and in the python bindings, which is why the bug has existed undetected for so long). Denying access to the readonly libvirt socket will avoid the potential for a denial of service attack, but will not prevent the deadlock if a privileged client passes a NULL argument, although such a hang is no longer a security problem.

Affected product: libvirt

Alternative formats: [xml] [text]