CVE-2024-2494: Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Other sources
A flaw was found in the RPC library APIs of libvirt. The RPC server de-serialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being treated as a huge positive number. A local unprivileged user could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.
— Red Hat
Libvirt: negative gnew0 length can lead to unbounded memory allocation
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2494?
CVE-2024-2494 has been classified as a high severity vulnerability due to the potential for application crashes.
How do I fix CVE-2024-2494?
To mitigate CVE-2024-2494, upgrade to the patched versions of libvirt as specified in the vulnerability documentation.
What systems are affected by CVE-2024-2494?
CVE-2024-2494 affects specific versions of libvirt on Ubuntu and Debian systems.
What causes the issue in CVE-2024-2494?
CVE-2024-2494 is caused by improper memory allocation in the RPC server's deserialization code.
Is CVE-2024-2494 easily exploitable?
Exploitation of CVE-2024-2494 is feasible in scenarios where malicious input can be passed to the affected libvirt APIs.