Moderate: libvirt security and bug fix update

2024-04-3000:00:00

Google

osv.dev

libvirt

virtualization

linux

operating systems

security fixes

bug fixes

remote management

cve-2024-1441

cve-2024-2494

off-by-one error

unbounded memory allocation

almalinux-9

jira:almalinux-25081

jira:almalinux-29515

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

17.8%

JSON

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fixes:

libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441)
libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes:

libvirt: off-by-one error in udevListInterfacesByStatus() [almalinux-9] (JIRA:AlmaLinux-25081)
libvirt: negative g_new0 length can lead to unbounded memory allocation [almalinux-9] (JIRA:AlmaLinux-29515)