NVD

Id
31794  
Name
CVE-2014-3633  
Description
The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:P)  
Pub Date
2017-01-19  
Published
2014-10-06  
Modified Date
2015-01-02  
Seq
2014-3633  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167544 31794 CVE-2014-3633 http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=3e745e8f775dfe6f64f18b5c2fe4791b35d3546b  View
167545 31794 CVE-2014-3633 openSUSE-SU-2014:1290  View
167546 31794 CVE-2014-3633 openSUSE-SU-2014:1293  View
167547 31794 CVE-2014-3633 RHSA-2014:1352  View
167548 31794 CVE-2014-3633 GLSA-201412-04  View
167549 31794 CVE-2014-3633 http://security.libvirt.org/2014/0004.html  View
167550 31794 CVE-2014-3633 DSA-3038  View
167551 31794 CVE-2014-3633 USN-2366-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15686 JVNDB-2014-004561 libvirt の qemu/qemu_driver.c 内の qemuDomainGetBlockIoTune 関数におけるサービス運用妨害 (DoS) の脆弱性 libvirt の qemu/qemu_driver.c の qemuDomainGetBlockIoTune 関数には、ディスクがホットプラグされている、またはライブイメージから削除されている場合、サービス運用妨害 (クラッシュ) 状態にされる、または重要なヒープ情報を読まれる脆弱性が存在します。 CVE-2014-3633 70921 CVE-2014-3633 31794 5.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004561.html 2014-09-17 2015-01-09 View