CVE-2013-6458
libvirt - several
EPSS 0.89%
Description
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.
How to fix CVE-2013-6458
To remediate CVE-2013-6458, upgrade the affected package to a fixed version below.
- Debian/libvirt—upgrade to 1.2.1-1 or later
- Debian/libvirt—upgrade to 0.9.12.3-1 or later
Is CVE-2013-6458 being exploited?
Low — EPSS is 0.9%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 1.2.1-1
- from 0, < 0.9.12.3-1