« Volver al listado

CVE-2014-3657

Estado: ModificadaMedia (5)—

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Libvirt — Libvirt

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3657",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-06T14:55:10.110",
  "references": [
    {
      "url": "http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1352.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/60291",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/62303",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://security.libvirt.org/2014/0005.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2404-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://libvirt.org/git/?p=libvirt.git%3Ba=commitdiff%3Bh=fc22b2e74890873848b43fffae43025d22053669",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00014.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00017.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1352.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60291",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/62303",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.libvirt.org/2014/0005.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2404-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command."
    },
    {
      "lang": "es",
      "value": "La función virDomainListPopulate en conf/domain_conf.c en libvirt anterior a 1.2.9 no limpia el bloqueo en la lista de dominios, lo que permite a atacantes remotos causar una denegación de servicio (bloqueo mutuo) a través de un valor nulo en el parámetro second en el comando de API virConnectListAllDomains."
    }
  ],
  "lastModified": "2026-06-17T00:08:42.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "990B5B59-DBA0-4116-BB1F-2B1D739C9835",
              "versionEndIncluding": "1.2.8"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5365060-478B-4A38-90F1-789BA17BA9A9"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69B82AB5-F91E-450D-AFD9-2D8551B79E1A"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDB00C9A-ACBA-4552-B76A-66D604514FEF"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA9E7374-0781-434B-B844-21786CC7DF7D"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F128034B-6365-4566-8E83-D7AD479FFC50"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3BC3A67-5922-45AE-B564-550EBCE01652"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26263705-26D6-416B-A88A-A99A1F888DD9"
            },
            {
              "criteria": "cpe:2.3:a:libvirt:libvirt:1.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D578358-EF2E-46E2-B586-F0BB169BD9B2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}