| Reported on: | 20141127 |
|---|---|
| Published on: | 20141205 |
| Fixed on: | 20141211 |
| Reported by: | Martin Kletzander |
|---|---|
| Patched by: | Martin Kletzander |
| Francesco Romani |
When using fine-grained ACLs to restrict users from accessing all domains, a logic bug in the qemu implementation of virConnectGetAllDomainStats could result in incorrect lock management of the next domain inspected after a domain that was skipped due to ACL restrictions.
A restricted client can trigger a denial of service against a more privileged user when libvirtd goes into deadlock when trying to lock an incorrectly locked domain, or crashes when trying to unlock a domain that was not locked.
Stop use of the fine grained access control mechanism, or stop trying to use access control to restrict the set of domains that an authorized client can see.