CVE-2013-6456

El controlador LXC (lxc/lxc_driver.c) en libvirt 1.0.1 hasta 1.2.1 permite a usuarios locales (1) borrar dispositivos arbitrarios a través de API virDomainDeviceDettach y un ataque symlink en /dev en el contenedor; (2) crear nodos arbitrarios (mknod) a través de la API virDomainDeviceAttach y un ataque symlink en /dev en el contenedor; y causar una denegación de servicio (apagado o reinicio del sistema operativo del host) a través de (3) virDomainShutdown o (4) virDomainReboot API y a un ataque symlink en /dev/initctl en el contenedor, relacionado con "rutas contenidas en /proc/$PID/root" y la función virInitctlSetRunLevel.

The LXC driver in libvirt 1.0.1 through 1.2.1 allows local users to delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the virDomainReboot API and a symlink attack on /dev/initctl in the container, related to paths under /proc//root and the virInitctlSetRunLevel function. libvirt was patched to prevent expansion of entities when parsing XML files. This vulnerability allowed malicious users to read arbitrary files or cause a denial of service. The updated packages have been upgraded to the 1.1.3.5 version and patched to correct these issues.