PT-2024-2717 · Libvirt+9 · Libvirt+9

Alexander Kuznetsov · Published 2024-03-01 · Updated 2025-04-11 · CVE-2024-1441

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description The issue is related to an off-by-one error flaw in the udevListInterfacesByStatus() function in libvirt. This flaw occurs when the number of interfaces exceeds the size of the names array. An unprivileged client can exploit this issue by sending specially crafted data to the libvirt daemon, allowing them to perform a denial of service attack by causing the libvirt daemon to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-193

Related Identifiers

ALSA-2024:2560

ALT-PU-2024-3419

ALT-PU-2024-3467

ALT-PU-2024-3772

ALT-PU-2024-4683

ALT-PU-2024-4685

ALT-PU-2024-6159

AZL-35848

AZL-38602

BDU:2024-02834

CVE-2024-1441

DLA-3778-1

INFSA-2024_2560

OESA-2024-1391

OESA-2024-1469

OPENSUSE-SU-2024:13759-1

RHSA-2024:2560

RHSA-2024_2560

RLSA-2024:2560

SUSE-SU-2024:1005-1

SUSE-SU-2024:1099-1

SUSE-SU-2024_1005-1

SUSE-SU-2024_1099-1

USN-6734-1

USN-6734-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libvirt

References · 77

• https://osv.dev/vulnerability/OESA-2024-1469 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-12536.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1441 · Security Note
• https://ubuntu.com/security/CVE-2024-2494 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2560.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1391 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6734-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/E6MVZO5GXDB7RHY6MS3ZXES3HPK34P3A · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6734-2 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38602 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1441 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:2560 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1099-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1441 · Vendor Advisory