Every CVE Search/ Get API key

CVE-2013-4311

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows...

4.6 MediumFix available

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Exploit likelihood

0.40%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.6

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
CVE-2013-4311
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
CVE-2013-4311
Updated
2026-11-02
EUVDEUVD-2013-4204 No score

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
EUVD-2013-4204
Updated
2026-11-03
GitHub AdvisoriesGHSA-pr6p-rw96-x62r No score

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows...

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
GHSA-pr6p-rw96-x62r
Updated
2026-11-02
OSV No score

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
CVE-2013-4311
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4311 No score

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Record
DEBIAN-CVE-2013-4311
Updated
2026-11-02
OSVMGASA-2013-0294 No score

Updated libvirt package fixes security vulnerabilities

It was discovered that libvirt incorrectly handled certain memory stats requests. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service (CVE-2013-4296).

It was discovered that libvirt incorrectly handled certain bitmap operations. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service (CVE-2013-5651).

Additionally, an update for a PolicyKit security issue required libvirt to be updated to use a different API that is not affected by this security issue (CVE-2013-4311).

Record
MGASA-2013-0294
Updated
2026-11-02
OSVopenSUSE-SU-2024:10209-1 No score

libvirt-2.5.0-1.1 on GA media

These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10209-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libvirt
Debian:12
 before 1.1.3~rc1-1
1.1.3~rc1-1
libvirt
Debian:13
 before 1.1.3~rc1-1
1.1.3~rc1-1
libvirt
Debian:14
 before 1.1.3~rc1-1
1.1.3~rc1-1
libvirt
Mageia:2
From an advisory covering 3 CVEs
 before 0.9.12-1.mga2
0.9.12-1.mga2
libvirt
Mageia:3
From an advisory covering 3 CVEs
 before 1.0.2-8.4.mga3
1.0.2-8.4.mga3
libvirt
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-client
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-python
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
Show 20 moreShow less
Affected packages
PackageAffectedFixed
libvirt-lock-sanlock
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-client
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-python
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-lock-sanlock
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-client
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-python
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-lock-sanlock
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-client
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-python
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt-lock-sanlock
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:0.10.2-18.el6_4.14
0:0.10.2-18.el6_4.14
libvirt
openSUSE:Tumbleweed
From an advisory covering 32 CVEs
 before 2.5.0-1.1
2.5.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4311 is a medium vulnerability (CVSS 4.6) in Redhat Libvirt, published October 3, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in libvirt 1.1.3~rc1-1.

References

Show 53 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open