CVE-2013-0241

2013-01-3000:00:00

ubuntu.com

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

5.1%

JSON

The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause
a denial of service (guest crash or hang) via a SPICE connection that
prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of
these details are obtained from third party information.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=906032>

Notes

Author	Note
mdeslaur	needs qemu-kvm patch (included in 1.0) http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=5ff4e36c oneiric and precise don’t have spice enabled in the qemu-kvm build. This probably only has an impact in environments where a precise guest is running on a host with spice enabled, and recent enough to supports async io. Downgrading priority to low.

OSVersionArchitecturePackageVersionFilename
ubuntu11.10noarchxserver-xorg-video-qxl< 0.0.14-1ubuntu0.1UNKNOWN
ubuntu12.04noarchxserver-xorg-video-qxl< 0.0.16-2ubuntu0.1UNKNOWN