CVE-2024-4418: Libvirt: stack use-after-free in virnetclientioeventloop()
A race condition leading to a stack use-after-free bug was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop().
Quoting libvirt maintainer Daniel P. Berrangé: The 'virtproxyd' daemon can be used to trigger requests which could potentially exercise the bug. If libvirt is configured with fine grained access control, this could in theory let a user escape their otherwise limited access. A local unprivileged user can access virtproxyd without authenticating. Remote users would need to authenticate before they could exercise it.
Other sources
A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.
— Ubuntu
Libvirt: stack use-after-free in virnetclientioeventloop()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libvirtto a version that resolves this vulnerability.Fixed in 10.0.0-2ubuntu8.2 - Upgrade
Upgrade
debian/libvirtto a version that resolves this vulnerability.Fixed in 5.0.0-4+deb10u1Fixed in 5.0.0-4+deb10u2Fixed in 7.0.0-3+deb11u2Fixed in 9.0.0-4Fixed in 10.3.0-3Fixed in 10.4.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4418?
CVE-2024-4418 is classified as a high-severity vulnerability due to the potential for exploitation via a race condition and use-after-free error.
How do I fix CVE-2024-4418?
To mitigate CVE-2024-4418, upgrade libvirt to version 10.0.0-2ubuntu8.2 for Ubuntu or one of the specified versions for Debian.
What platforms are affected by CVE-2024-4418?
CVE-2024-4418 affects libvirt on Ubuntu and Debian systems.
What is the attack vector for CVE-2024-4418?
The attack vector for CVE-2024-4418 involves exploiting a race condition that leads to unexpected behavior in libvirt's networking functionalities.
Is there a workaround for CVE-2024-4418?
There are no known workarounds for CVE-2024-4418, so the recommended action is to apply the available security updates.