CVE-2024-2494: Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Other sources
A flaw was found in the RPC library APIs of libvirt. The RPC server de-serialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being treated as a huge positive number. A local unprivileged user could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
— Red Hat
Libvirt: negative gnew0 length can lead to unbounded memory allocation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libvirtto a version that resolves this vulnerability.Fixed in 6.0.0-0ubuntu8.19 - Upgrade
Upgrade
ubuntu/libvirtto a version that resolves this vulnerability.Fixed in 8.0.0-1ubuntu7.10 - Upgrade
Upgrade
ubuntu/libvirtto a version that resolves this vulnerability.Fixed in 9.6.0-1ubuntu1.1 - Upgrade
Upgrade
ubuntu/libvirtto a version that resolves this vulnerability.Fixed in 10.0.0-2ubuntu8.1 - Upgrade
Upgrade
debian/libvirtto a version that resolves this vulnerability.Fixed in 9.0.0-4+deb12u1 - Upgrade
Upgrade
debian/libvirtto a version that resolves this vulnerability.Fixed in 10.2.0-1 - Upgrade
Upgrade
debian/libvirtto a version that resolves this vulnerability.Fixed in 9.0.0-4+deb12u2Fixed in 11.3.0-3+deb13u3Fixed in 12.8.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2494?
CVE-2024-2494 has been classified as a high severity vulnerability due to the potential for application crashes.
How do I fix CVE-2024-2494?
To mitigate CVE-2024-2494, upgrade to the patched versions of libvirt as specified in the vulnerability documentation.
What systems are affected by CVE-2024-2494?
CVE-2024-2494 affects specific versions of libvirt on Ubuntu and Debian systems.
What causes the issue in CVE-2024-2494?
CVE-2024-2494 is caused by improper memory allocation in the RPC server's deserialization code.
Is CVE-2024-2494 easily exploitable?
Exploitation of CVE-2024-2494 is feasible in scenarios where malicious input can be passed to the affected libvirt APIs.