CVE-2024-2494

Summary

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.

Affected Software

VendorProductVersion RangeStatus
9.0.0 < 9.7.0affected
Red HatRed Hat Enterprise Linux 88100020240409073027.489197e6 < *unaffected
Red HatRed Hat Enterprise Linux 88100020240409073027.489197e6 < *unaffected
Red HatRed Hat Enterprise Linux 90:10.0.0-6.2.el9_4 < *unaffected

Weaknesses

  • CWE-789: Memory Allocation with Excessive Size Value

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References