CVE-2014-0179

What it actually does

The flaw permits local attackers to submit crafted XML containing external entity declarations to the virConnectCompareCPU and virConnectBaselineCPU API methods, triggering an XXE condition that causes the libvirt daemon to block on external resource reads and hang.

Why it matters to the business

Successful exploitation produces denial-of-service against virtualization management operations, potentially interrupting VM provisioning, migration, and host inventory tasks on affected systems until the process is restarted.

How an attack unfolds

A local user on a system running an affected libvirt version crafts an XML document that declares an external entity and references it within a call to virConnectCompareCPU or virConnectBaselineCPU; when the API processes the document it attempts to resolve the entity, blocking the daemon thread and causing a hang.

How to fix it

Upgrade libvirt to version 1.2.5 or later on all affected Red Hat Enterprise Linux, Red Hat Enterprise Virtualization, and openSUSE systems; disable or restrict local access to the CompareCPU and BaselineCPU APIs until patches are applied if immediate upgrade is not feasible.

How to confirm the fix worked

Confirm installed libvirt version is 1.2.5 or newer; test the fixed APIs with a benign XXE payload to verify that external entity expansion is rejected and no hang occurs; review package changelogs for the XXE mitigation commit.

Typical attack path

1. Obtain local shell access on a host running vulnerable libvirt
2. Construct malicious XML containing an external entity declaration
3. Invoke virConnectCompareCPU or virConnectBaselineCPU with the crafted XML via libvirt client or direct API call
4. Observe daemon thread blocking on external entity resolution, resulting in service hang

How to detect it

Review libvirt daemon logs for repeated or long-running CompareCPU/BaselineCPU calls containing XML entity references; correlate with system process hangs or high-wait states in the libvirtd process; examine audit logs for local users invoking libvirt client binaries around the time of service degradation.

What your security team should do

• Prioritize upgrade of all libvirt packages to 1.2.5+ across the environment due to the public disclosure age and potential for local privilege escalation chains
• Restrict local user access to libvirt APIs via policy or SELinux/AppArmor profiles until patches are deployed
• Monitor for unusual libvirt daemon CPU or thread activity that could indicate attempted exploitation