Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 470096 (CVE-2013-1962) - <app-emulation/libvirt-1.0.5.1-r3 : DoS (max count of open files exhaustion) due sockets leak in the storage pool (CVE-2013-1962)
Summary: <app-emulation/libvirt-1.0.5.1-r3 : DoS (max count of open files exhaustion) ...
Status: RESOLVED FIXED
Alias: CVE-2013-1962
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [glsa]
Keywords:
Depends on: 472724
Blocks:
  Show dependency tree
 
Reported: 2013-05-16 18:19 UTC by Agostino Sarubbo
Modified: 2013-09-25 17:19 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-05-16 18:19:23 UTC
From ${URL} :

A denial of service flaw was found in the way storage pool manager of libvirt, a C toolkit to 
interact with the virtualization capabilities of recent versions of Linux (and other OSes), 
performed management of socket file descriptors when 'to list all volumes for the particular pool' 
request was issued (two socket file descriptors were leaked per "list all pool volumes" request). 
An uprivileged user could use this flaw to cause denial of service (make libvirtd daemon to exhaust 
/ reach the maximum count of open file descriptors, the libvirtd daemon process was allowed to 
open, possibly preventing other users from use of libvirtd services till the libvirtd daemon was 
restarted).

Upstream patch:

https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Comment 1 Doug Goldstein gentoo-dev 2013-06-04 21:49:26 UTC
This has been fixed in the tree. Use libvirt-1.0.5.1-r2.

TARGET_KEYWORDS=amd64 x86
Comment 2 Doug Goldstein gentoo-dev 2013-06-09 22:43:58 UTC
(In reply to Doug Goldstein from comment #1)
> This has been fixed in the tree. Use libvirt-1.0.5.1-r2.
> 
> TARGET_KEYWORDS=amd64 x86

Please stabilize 1.0.5.1-r3. Any version 1.0.5 or newer will satisfy this CVE.
Comment 3 Agostino Sarubbo gentoo-dev 2013-06-11 10:19:46 UTC
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2013-06-11 10:20:20 UTC
x86 stable
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2013-08-30 00:23:30 UTC
CVE-2013-1962 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1962):
  The remoteDispatchStoragePoolListAllVolumes function in the storage pool
  manager in libvirt 1.0.5 allows remote attackers to cause a denial of
  service (file descriptor consumption) via a large number of requests "to
  list all volumes for the particular pool."
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2013-09-25 17:19:02 UTC
This issue was resolved and addressed in
 GLSA 201309-18 at http://security.gentoo.org/glsa/glsa-201309-18.xml
by GLSA coordinator Chris Reffett (creffett).