Description
The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libvirt | 1.1.4-1 | — |
| Debian 13 | libvirt | 1.1.4-1 | — |
| Debian 12 | libvirt | 1.1.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libvirt +4 | 0.10.2-29.el6 | RHBA-2013:1581 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Gluster Storage 3 | libvirt-lock-sanlock | 0.10.2-29.el6 | RHBA-2013:1581 |
Advisories 1
- RHBA-2013:1581 Red Hat Bug Fix Advisory: libvirt bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://libvirt.org/news.html
- 60895 third-party-advisory
- GLSA-201412-04 vendor-advisory
- http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=484cc321
- openSUSE-SU-2014:0593 vendor-advisory
- [oss-security] 20140318 CVE request -- libvirt: unprivileged user can crash libvirtd during spice migration mailing-list
- [oss-security] 20140318 Re: CVE request -- libvirt: unprivileged user can crash libvirtd during spice migration mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1077620