Homepage

Link Following The advisory has been revoked - it doesn't affect any version of package libvirt  (opens in a new tab)

Threat Intelligence

EPSS
0.58% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1210-LIBVIRT-633944
  • published10 Sept 2020
  • disclosed15 Apr 2014
Report a new vulnerability Found a mistake?

Introduced: 15 Apr 2014

CVE-2013-6456  (opens in a new tab)
CWE-59  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:12.10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libvirt package and not the libvirt package as distributed by Ubuntu.

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.