CVE-2012-3445
Priority
Medium
Description
The virTypedParameterArrayClear function in libvirt 0.9.13 does not
properly handle virDomain* API calls with typed parameters, which might
allow remote authenticated users to cause a denial of service (libvirtd
crash) via an RPC command with nparams set to zero, which triggers an
out-of-bounds read or a free of an invalid pointer.
properly handle virDomain* API calls with typed parameters, which might
allow remote authenticated users to cause a denial of service (libvirtd
crash) via an RPC command with nparams set to zero, which triggers an
out-of-bounds read or a free of an invalid pointer.
References
Bugs
Notes
mdeslaur> precise and earlier don't have virTypedParameterArrayClear, so
mdeslaur> no invalid free possible.
mdeslaur> no invalid free possible.
Assigned-to
mdeslaur
Package
| Upstream: | needs-triage |
| Ubuntu 8.04 LTS (Hardy Heron): | ignored (reached end-of-life) |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected (code not present) |
| Ubuntu 11.04 (Natty Narwhal): | not-affected (code not present) |
| Ubuntu 11.10 (Oneiric Ocelot): | not-affected (code not present) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (code not present) |
| Ubuntu 12.10 (Quantal Quetzal): | released (0.9.13-0ubuntu11) |
Patches:
| Upstream: | http://libvirt.org/git/?p=libvirt.git;a=commit;h=6039a2cb49c8af4c68460d2faf365a7e1c686c7b |