CVE-2015-5247 — MEDIUM (6.5)

Vulnerability Description

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Redhat	Libvirt	1.2.14
Canonical	Ubuntu Linux	12.04

Related Weaknesses (CWE)

CWE-284

References

http://security.libvirt.org/2015/0003.htmlVendor Advisory
http://www.ubuntu.com/usn/USN-2867-1
http://security.libvirt.org/2015/0003.htmlVendor Advisory
http://www.ubuntu.com/usn/USN-2867-1

FAQ

What is CVE-2015-5247?

CVE-2015-5247 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unli...

How severe is CVE-2015-5247?

CVE-2015-5247 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-5247?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Libvirt, Canonical Ubuntu Linux.