CVE-2013-6456 — Vulnetix

Try Vulnetix Request Demo

CVE-2013-6456 REJECTED

The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.

EPSS 0.28% · 51.2th percentile

Risk Scores

EPSS Score

0.28%

51.2th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:14.04:LTS	libvirt	0, 1.1.1-0ubuntu8, 1.1.1-0ubuntu9

Timeline

Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 19, 2023 EPSS Score
Jul 10, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2013-6456 third-party-advisory
http://security.libvirt.org/2013/0018.html third-party-advisory
https://ubuntu.com/security/notices/USN-2209-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2013-6456 third-party-advisory

Open in Interactive Console →