CVE-2024-1441
Libvirt: off-by-one error in udevlistinterfacesbystatus()
Summary
Libvirt: off-by-one error in udevlistinterfacesbystatus()
Original description
The description as published by the source.
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-1441 libvirt Fixed in: 7.0.0-3+deb11u3
- Ubuntu UBUNTU-CVE-2024-1441 libvirt Fixed in: 1.2.2-0ubuntu13.1.28+esm2
References
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- package gitlab.com
- report bugzilla.redhat.com
- web access.redhat.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org