CVE-2024-1441 Libvirt: off-by-one error in udevlistinterfacesbystatus()

2024-03-1113:37:54

CWE-193

redhat

github.com

cve-2024-1441

libvirt

off-by-one error

udevlistinterfacesbystatus()

denial of service

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

Percentile

16.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.