PT-2024-6094 · Libvirt+6 · Libvirt+6

Published 2024-08-30 · Updated 2025-12-22 · CVE-2024-8235

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description A flaw was found in libvirt related to a NULL-pointer dereference. This issue occurs due to a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer, leading to a crash of the virtinterfaced daemon. The problem arises from a refactor of the code fetching the list of interfaces for multiple APIs. This could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2024:9128

ALT-PU-2024-13761

ALT-PU-2024-14221

ALT-PU-2025-15732

BDU:2024-07002

CVE-2024-8235

INFSA-2024_9128

OPENSUSE-SU-2024:14315-1

RHSA-2024:9128

RHSA-2024_9128

RLSA-2024:9128

Affected Products

Alt Linux

Almalinux

Astra Linux

Red Hat

Red Os

Rocky Linux

Libvirt

References · 34

• https://osv.dev/vulnerability/RLSA-2024:9128 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-9128.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-9128.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-8235 · Security Note
• https://access.redhat.com/security/cve/CVE-2024-8235 · Vendor Advisory
• https://lists.libvirt.org/archives/list/[e-mail]/thread/X6WOVCL6QF3FQRFIIXL736RFZVSUWLWJ · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:14315-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-8235 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8235 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-8235 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-8235 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8235 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-8235 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2308680 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:9128 · Vendor Advisory