CVE-2013-0241

Published: 30 January 2013

The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information.

Notes

needs qemu-kvm patch (included in 1.0)
http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=5ff4e36c
oneiric and precise don't have spice enabled in the qemu-kvm
build. This probably only has an impact in environments where
a precise guest is running on a host with spice enabled, and
recent enough to supports async io. Downgrading priority to
low.

Status

References

• http://www.openwall.com/lists/oss-security/2013/01/30
• https://ubuntu.com/security/notices/USN-1714-1
• https://www.cve.org/CVERecord?id=CVE-2013-0241
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=906032