Summary
USN-6734-1 fixed vulnerabilities in libvirt. This update provides the
corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
Alexander Kuznetsov discovered that libvirt incorrectly handled certain API
calls. An attacker could possibly use this issue to cause libvirt to crash,
resulting in a denial of service. (CVE-2024-1441)
It was discovered that libvirt incorrectly handled certain RPC library API
calls. An attacker could possibly use this issue to cause libvirt to crash,
resulting in a denial of service. (CVE-2024-2494)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | libvirt | 10.0.0-2ubuntu8.1 |
Vulnerabilities 2
-
Medium 6.2
Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a cra…
-
Medium 5.5CVE-2024-1441 Public exploit
Libvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an u…