CVE-2014-3657

What it actually does

The virDomainListPopulate function fails to release a domain list lock when virConnectListAllDomains receives a NULL second parameter, leaving the lock held and causing a permanent deadlock in the libvirt daemon.

Why it matters to the business

Virtualization management services become unresponsive, blocking VM lifecycle operations, migrations, and monitoring across any systems that rely on the affected libvirt instance until the process is restarted.

How an attack unfolds

An attacker with network reachability to a libvirt daemon issues the virConnectListAllDomains API call supplying NULL for the domain list pointer; the missing unlock in virDomainListPopulate causes the global lock to remain held, deadlocking subsequent API consumers and the management stack.

How to fix it

Upgrade libvirt to version 1.2.9 or later; if immediate upgrade is not possible, restrict network access to the libvirt socket or daemon and restart the libvirtd process when deadlock symptoms appear.

How to confirm the fix worked

After patching, confirm the installed libvirt version is at least 1.2.9, then exercise virConnectListAllDomains with a NULL list pointer in a test environment and verify the daemon continues to service subsequent calls without deadlock.

Typical attack path

1. Obtain network access to the libvirt daemon port
2. Authenticate or exploit an exposed unauthenticated libvirt socket
3. Invoke virConnectListAllDomains with a NULL second argument
4. Observe that the daemon no longer processes further API requests
5. Maintain the condition to sustain denial of service

How to detect it

Review libvirt daemon logs for repeated or stalled domain listing operations, monitor for sustained high CPU or unresponsive API behavior, and correlate with any external connections attempting virConnectListAllDomains calls around the time of service degradation.

What your security team should do

• Prioritize upgrade of all libvirt installations to 1.2.9 or newer
• Restrict libvirt daemon exposure to only trusted management networks
• Implement process monitoring and automatic restart for libvirtd on deadlock detection
• Review and tighten API authentication and authorization settings