What’s Vulnerable › Vulnerabilities

CVE-2014-8136

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-12-19 · updated 2026-06-17
• Weakness: CWE-264

Description

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 15.04, 15.10
• Mageia: 4.0
• Opensuse: 13.1, 13.2
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Hpc Node: 7.0
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Workstation: 7.0
• libvirt: all versions

References

• http://advisories.mageia.org/MGASA-2015-0002.html
• http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=2bdcd29c713dfedd813c89f56ae98f6f3898313d
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00003.html
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html
• http://rhn.redhat.com/errata/RHSA-2015-0323.html
• http://secunia.com/advisories/61111
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:023
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:070
• http://www.ubuntu.com/usn/USN-2867-1
• http://advisories.mageia.org/MGASA-2015-0002.html
• http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=2bdcd29c713dfedd813c89f56ae98f6f3898313d
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00003.html

Get alerted when CVE-2014-8136 or the next vulnerability affects your stack