NULL pointer dereference in libvirt - CVE-2024-2496

Vulnerability identifier: #VU88535

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-2496

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the udevConnectListAllInterfaces() function. A local user can trigger a NULL pointer dereference error when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API.

libvirt
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
openEuler
Ubuntu
libvirt-daemon (Ubuntu package)
libvirt-daemon-system (Ubuntu package)
libvirt0 (Ubuntu package)
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-secret
libvirt-daemon-driver-storage
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-nwfilter
libvirt-daemon-kvm
libvirt-daemon-qemu
libvirt-debuginfo
libvirt-debugsource
libvirt-devel
libvirt-docs
libvirt-libs
libvirt-daemon-driver-qemu
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-network
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-client
libvirt-bash-completion
libvirt-admin
libvirt
libvirt-lock-sanlock
libvirt-nss
libvirt-wireshark
libvirt (Red Hat package)

Install update from vendor's website.

libvirt - update to 9.8.0
libvirt-daemon (Ubuntu package) - addressed in versions 6.0.0-0ubuntu8.19, 8.0.0-1ubuntu7.10, 9.6.0-1ubuntu1.1
libvirt-daemon-system (Ubuntu package) - addressed in versions 6.0.0-0ubuntu8.19, 8.0.0-1ubuntu7.10, 9.6.0-1ubuntu1.1
libvirt0 (Ubuntu package) - addressed in versions 6.0.0-0ubuntu8.19, 8.0.0-1ubuntu7.10, 9.6.0-1ubuntu1.1
libvirt-daemon-driver-storage-scsi - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-secret - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-core - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-disk - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-gluster - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-iscsi - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-iscsi-direct - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-logical - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-mpath - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-storage-rbd - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-nwfilter - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-kvm - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-qemu - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-debuginfo - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-debugsource - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-devel - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-docs - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-libs - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-qemu - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-nodedev - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-network - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-driver-interface - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-config-nwfilter - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon-config-network - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-daemon - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-client - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-bash-completion - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-admin - addressed in versions 6.2.0-25, 6.2.0-65
libvirt - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-lock-sanlock - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-nss - addressed in versions 6.2.0-25, 6.2.0-65
libvirt-wireshark - addressed in versions 6.2.0-25, 6.2.0-65
libvirt (Red Hat package) - update to 10.0.0-6.el9_4

• https://access.redhat.com/security/cve/CVE-2024-2496
• https://bugzilla.redhat.com/show_bug.cgi?id=2269672
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html

• Local denial of service in libvirt
• Ubuntu update for libvirt
• Red Hat Enterprise Linux 9 update for libvirt
• openEuler 20.03 LTS SP4 update for libvirt
• openEuler 22.03 LTS SP1 update for libvirt
• openEuler 22.03 LTS SP3 update for libvirt