VulnerabilityModified

CVE-2013-6458

MEDIUM 6.8EPSS 0.59%

Does this matter?

Lower severity and a low EPSS score (0.59%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.

CVSS 2.0: 6.8 MEDIUMAV:A/AC:H/Au:N/C:C/I:C/A:C
EPSS: 0.59% probability · 46th percentile
CISA KEV: Not listed
Weakness: CWE-362
Affected: redhat/libvirt
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.