Off-by-one in libvirt - CVE-2024-1441

Vulnerability identifier: #VU87448

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-1441

CWE-ID: CWE-193

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error in the udevListInterfacesByStatus() function when the number of interfaces exceeds the size of the "names" array. A local user can trigger an off-by-one error and crash the daemon.

libvirt
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
Ubuntu
Anolis OS
Fedora
libvirt-daemon-system (Ubuntu package)
libvirt-daemon (Ubuntu package)
libvirt0 (Ubuntu package)
libvirt-daemon-driver-nodedev
libvirt-bash-completion
libvirt-wireshark
libvirt-daemon-driver-network
libvirt-daemon-config-nwfilter
libvirt-daemon-kvm
libvirt-daemon-driver-storage-rbd
libvirt-daemon-qemu
libvirt-daemon-driver-interface
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage
libvirt-debugsource
libvirt-docs
libvirt-client
libvirt-daemon-config-network
libvirt-daemon-driver-qemu
libvirt-daemon-driver-storage-iscsi
libvirt
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage-mpath
libvirt-devel
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-gluster
libvirt-nss
libvirt-daemon-driver-storage-iscsi-direct
libvirt-libs
libvirt-admin
libvirt-daemon
libvirt-daemon-driver-storage-core
libvirt-debuginfo
libvirt-lock-sanlock
libvirt-daemon-driver-storage-logical
libvirt-daemon-plugin-lockd
libvirt-daemon-lock
libvirt-daemon-log
libvirt-daemon-plugin-sanlock
libvirt-daemon-proxy
libvirt-client-qemu
libvirt-daemon-common
libvirt (Red Hat package)

Install updates from vendor's website.

libvirt - update to 10.1.0
libvirt-daemon-system (Ubuntu package) - addressed in versions 6.0.0-0ubuntu8.19, 8.0.0-1ubuntu7.10, 9.6.0-1ubuntu1.1, 10.0.0-2ubuntu8.1
libvirt-daemon (Ubuntu package) - addressed in versions 6.0.0-0ubuntu8.19, 8.0.0-1ubuntu7.10, 9.6.0-1ubuntu1.1, 10.0.0-2ubuntu8.1
libvirt0 (Ubuntu package) - addressed in versions 6.0.0-0ubuntu8.19, 8.0.0-1ubuntu7.10, 9.6.0-1ubuntu1.1, 10.0.0-2ubuntu8.1
libvirt-daemon-driver-nodedev - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-bash-completion - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-wireshark - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-network - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-config-nwfilter - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-kvm - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-rbd - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-qemu - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-interface - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-disk - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-debugsource - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-docs - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-client - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-config-network - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-qemu - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-iscsi - addressed in versions 6.2.0-20, 6.2.0-24
libvirt - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-nwfilter - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-secret - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-mpath - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-devel - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-scsi - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-gluster - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-nss - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-iscsi-direct - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-libs - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-admin - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-core - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-debuginfo - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-lock-sanlock - addressed in versions 6.2.0-20, 6.2.0-24
libvirt-daemon-driver-storage-logical - addressed in versions 6.2.0-20, 6.2.0-24
libvirt - addressed in versions 9.0.0-5.fc38, 9.7.0-3.fc39
libvirt-daemon-plugin-lockd - update to 9.10.0-5
libvirt-daemon-driver-storage-gluster - update to 9.10.0-5
libvirt-daemon-driver-storage-iscsi - update to 9.10.0-5
libvirt-daemon-driver-storage-iscsi-direct - update to 9.10.0-5
libvirt-daemon-driver-storage-logical - update to 9.10.0-5
libvirt-daemon-driver-storage-mpath - update to 9.10.0-5
libvirt-daemon-driver-storage-scsi - update to 9.10.0-5
libvirt-daemon-kvm - update to 9.10.0-5
libvirt-daemon-lock - update to 9.10.0-5
libvirt-daemon-log - update to 9.10.0-5
libvirt-daemon-driver-storage-disk - update to 9.10.0-5
libvirt-daemon-plugin-sanlock - update to 9.10.0-5
libvirt-daemon-proxy - update to 9.10.0-5
libvirt-daemon-qemu - update to 9.10.0-5
libvirt-devel - update to 9.10.0-5
libvirt-docs - update to 9.10.0-5
libvirt-libs - update to 9.10.0-5
libvirt-nss - update to 9.10.0-5
libvirt-wireshark - update to 9.10.0-5
libvirt-daemon-driver-storage-core - update to 9.10.0-5
libvirt - update to 9.10.0-5
libvirt-client - update to 9.10.0-5
libvirt-client-qemu - update to 9.10.0-5
libvirt-daemon - update to 9.10.0-5
libvirt-daemon-common - update to 9.10.0-5
libvirt-daemon-config-network - update to 9.10.0-5
libvirt-daemon-config-nwfilter - update to 9.10.0-5
libvirt-daemon-driver-interface - update to 9.10.0-5
libvirt-daemon-driver-network - update to 9.10.0-5
libvirt-daemon-driver-nodedev - update to 9.10.0-5
libvirt-daemon-driver-nwfilter - update to 9.10.0-5
libvirt-daemon-driver-qemu - update to 9.10.0-5
libvirt-daemon-driver-secret - update to 9.10.0-5
libvirt-daemon-driver-storage - update to 9.10.0-5
libvirt (Red Hat package) - update to 10.0.0-6.2.el9_4

• https://access.redhat.com/security/cve/CVE-2024-1441
• https://bugzilla.redhat.com/show_bug.cgi?id=2263841

• Denial of service in libvirt
• Fedora 38 update for libvirt
• Fedora 39 update for libvirt
• openEuler update for libvirt
• Ubuntu update for libvirt
• openEuler 20.03 LTS SP4 update for libvirt
• Ubuntu update for libvirt
• Red Hat Enterprise Linux 9 update for libvirt
• Anolis OS update for libvirt