CVE-2024-2494
Published: March 22, 2024Last modified: June 9, 2025
Description
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.2 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | libvirt | Vulnerable (8.9.0-r4) |
| Stream | libvirt | Fixed (10.2.0-r0) |
References
- https://access.redhat.com/errata/RHSA-2024:2560
- https://access.redhat.com/errata/RHSA-2024:3253
- https://access.redhat.com/security/cve/CVE-2024-2494
- https://bugzilla.redhat.com/show_bug.cgi?id=2270115
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://lists.libvirt.org/archives/list/[email protected]/thread/BKRQXPLPC6B7FLHJXSBQYW7HNDEBW6RJ/
- https://security.netapp.com/advisory/ntap-20240517-0009/