CVE-2024-1441: Libvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
Other sources
An off-by-one error was found in libvirt in the udevListInterfacesByStatus() function when the number of interfaces exceeds nameslen. The issue can be reproduced by sending a specially crafted entry to the libvirt daemon and can lead to a segmentation fault. An unprivileged user could use this flaw to cause a denial of service condition.
— Red Hat
Libvirt: off-by-one error in udevlistinterfacesbystatus()
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1441?
CVE-2024-1441 has a medium severity rating due to its potential to be exploited by unprivileged clients.
How do I fix CVE-2024-1441?
To fix CVE-2024-1441, update the libvirt package to version 10.1.0 for Red Hat, 6.0.0-0ubuntu8.19 for focal, 8.0.0-1ubuntu7.10 for jammy, or 9.6.0-1ubuntu1.1 for mantic.
What causes CVE-2024-1441?
CVE-2024-1441 is caused by an off-by-one error in the udevListInterfacesByStatus() function of libvirt when handling a number of interfaces that exceeds the size of the names array.
Which versions of libvirt are affected by CVE-2024-1441?
Affected versions of libvirt include versions prior to 10.1.0 for Red Hat, and several specific Ubuntu and Debian versions listed in the vulnerability report.
Can CVE-2024-1441 be exploited remotely?
Yes, CVE-2024-1441 can be exploited remotely by sending specially crafted data to the libvirt daemon.