CVE-2013-6456
- State
- Published
- Severity
- Not scored
- Published
- Apr 15, 2014
- Updated
- Aug 6, 2024
- Reserved
- Nov 4, 2013
Description
The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://libvirt.org/news.html
- 56187third-party-advisory
- 60895third-party-advisory
- GLSA-201412-04vendor-advisory
- http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5fc590ad9f4
- openSUSE-SU-2014:0593vendor-advisory
- http://security.libvirt.org/2013/0018.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1045643
- FEDORA-2014-2864vendor-advisory
- 65743vdb-entry
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732394
- 56215third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.