CVE-2024-2494
Assigner: redhat
Published: 2024-03-21T13:39:08.847Z
State: PUBLISHED
title: Libvirt: negative g_new0 length can lead to unbounded memory allocation
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
descriptions: value: A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
affected: vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: virt-devel:rhel
defaultStatus: affected
versions: version: 8100020240409073027.489197e6
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:8::appstream
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: virt:rhel
defaultStatus: affected
versions: version: 8100020240409073027.489197e6
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:8::crb
cpe:/a:redhat:enterprise_linux:8::appstream
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: libvirt
defaultStatus: affected
versions: version: 0:10.0.0-6.2.el9_4
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:9::crb
cpe:/a:redhat:enterprise_linux:9::appstream
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: libvirt
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: libvirt
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 8 Advanced Virtualization
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: virt:av/libvirt
defaultStatus: affected
cpes: cpe:/a:redhat:advanced_virtualization:8::el8
datePublic: 2024-03-21T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-789
description: Memory Allocation with Excessive Size Value
type: CWE
x_redhatCweChain: CWE-789: Memory Allocation with Excessive Size Value
workarounds: value: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
timeline: time: 2024-03-18T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-03-21T00:00:00+00:00
value: Made public.
credits: value: Red Hat would like to thank Alexander Kuznetsov (ALT Linux Team) for reporting this issue.