CVE-2024-2494
Published: 20 March 2024
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Priority
Status
Package | Release | Status |
---|---|---|
libvirt
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Released
(6.0.0-0ubuntu8.19)
|
|
jammy |
Released
(8.0.0-1ubuntu7.10)
|
|
mantic |
Released
(9.6.0-1ubuntu1.1)
|
|
noble |
Released
(10.0.0-2ubuntu8.1)
|
|
trusty |
Needs triage
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
|
Patches:
upstream: https://gitlab.com/libvirt/libvirt/-/commit/8a3f8d957507c1f8223fdcf25a3ff885b15557f2 |