CVE-2014-3657 - CVE House
Back to Database
Status published Medium CVE-2014-3657

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does...

Vulnerability Description

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-3657

Credits & Attribution

No credits recorded in the NVD database.

References

More from libvirt

View All →
CVE-2020-10703
A NULL pointer dereference was found in the libvirt API...
Medium 6.5
CVE-2019-10168
The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and...
High 8.8
CVE-2019-10167
The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x...
High 8.8
CVE-2019-10166
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and...
High 7.8
CVE-2019-10132
A vulnerability was found in libvirt >= 4.1.0 in the...
High 8.8

Affected Vendor

Affected Software

libvirt
Vulnerable Versions:
0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7

Timeline

Official Publish: October 6th, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.