{"id":"CVE-2013-6456","aliases":["DEBIAN-CVE-2013-6456","EUVD-2013-6263","GHSA-4c8j-w686-c2jw","MGASA-2014-0243","UBUNTU-CVE-2013-6456","openSUSE-SU-2024:10209-1"],"status":"published","title":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete...","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","severity":{"version":"2.0","score":5.8,"vector":"AV:A/AC:M/Au:S/C:N/I:P/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00577,"percentile":0.47855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2014-04-15T00:00:00Z","modified":"2026-09-01T20:03:19Z","fixes":[{"ecosystem":"Debian:12","package":"libvirt","fixed_in":["1.2.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvirt","fixed_in":["1.2.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvirt","fixed_in":["1.2.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-8.5.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"libvirt"}],"references":[{"url":"http://libvirt.org/news.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/56187","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/60895","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-201412-04.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5fc590ad9f4","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://security.libvirt.org/2013/0018.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045643","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129199.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/65743","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732394","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://secunia.com/advisories/56215","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6456"},{"url":"http://libvirt.org/git/?p=libvirt.git;a=commit;h=5fc590ad9f4"},{"url":"https://github.com/advisories/GHSA-4c8j-w686-c2jw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-6456","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0243.html","tags":["advisory"]},{"url":"http://security.libvirt.org/2014/0003.html","tags":["web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html","tags":["web"]},{"url":"http://www.mandriva.com/en/support/security/advisories/mbs1/MDVSA-2014:097/","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12920","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-6456","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2209-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6456","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5313","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-6456","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"published","published":"2014-04-15T18:00:00Z","modified":"2024-08-06T17:39:01.476Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6263","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"published","published":"2014-04-15T18:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-4c8j-w686-c2jw","title":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete...","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"published","published":"2022-05-17T04:18:14Z","modified":"2023-02-13T00:30:36Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:54:04.926808Z"}],"nvd":[{"id":"CVE-2013-6456","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"published","published":"2014-04-15T23:55:08.547Z","modified":"2026-06-17T00:00:31.717Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:A/AC:M/Au:S/C:N/I:P/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"CVE-2013-6456","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"published","published":"2014-04-15T23:55:08Z","modified":"2026-04-16T06:15:57.507885555Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-6456","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"published","published":"2014-04-15T23:55:08.547Z","modified":"2026-09-01T20:03:19.060811181Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0243","title":"Updated libvirt packages fix multiple vulnerabilities","description":"Updated libvirt packages fix security vulnerabilities:\n\nThe LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through\n1.2.1 allows local users to (1) delete arbitrary host devices\nvia the virDomainDeviceDettach API and a symlink attack on /dev\nin the container; (2) create arbitrary nodes (mknod) via the\nvirDomainDeviceAttach API and a symlink attack on /dev in the\ncontainer; and cause a denial of service (shutdown or reboot host\nOS) via the (3) virDomainShutdown or (4) virDomainReboot API and a\nsymlink attack on /dev/initctl in the container, related to paths under\n/proc//root and the virInitctlSetRunLevel function (CVE-2013-6456).\n\nlibvirt was patched to prevent expansion of entities when parsing XML\nfiles. This vulnerability allowed malicious users to read arbitrary\nfiles or cause a denial of service (CVE-2014-0179).\n","status":"published","published":"2014-05-29T07:01:13Z","modified":"2026-04-16T06:23:39.373669665Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10209-1","title":"libvirt-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the libvirt-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:02.434926Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2013-6456","description":"The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to \"paths under /proc/$PID/root\" and the virInitctlSetRunLevel function.","status":"withdrawn","published":"2014-04-15T00:00:00Z","modified":"2026-02-04T02:43:58.387864Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}