CVE-2024-1441

2024-03-1113:37:54

Debian Security Bug Tracker

security-tracker.debian.org

off-by-one error

udevlistinterfacesbystatus

libvirt

denial of service

unprivileged client

crash

unix

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.8%

JSON

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.

OSVersionArchitecturePackageVersionFilename
Debian12alllibvirt<= 9.0.0-4libvirt_9.0.0-4_all.deb
Debian11alllibvirt<= 7.0.0-3+deb11u2libvirt_7.0.0-3+deb11u2_all.deb
Debian10alllibvirt< 5.0.0-4+deb10u2libvirt_5.0.0-4+deb10u2_all.deb
Debian999alllibvirt< 10.1.0-1libvirt_10.1.0-1_all.deb
Debian13alllibvirt< 10.1.0-1libvirt_10.1.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	libvirt	<= 9.0.0-4	libvirt_9.0.0-4_all.deb
Debian	11	all	libvirt	<= 7.0.0-3+deb11u2	libvirt_7.0.0-3+deb11u2_all.deb
Debian	10	all	libvirt	< 5.0.0-4+deb10u2	libvirt_5.0.0-4+deb10u2_all.deb
Debian	999	all	libvirt	< 10.1.0-1	libvirt_10.1.0-1_all.deb
Debian	13	all	libvirt	< 10.1.0-1	libvirt_10.1.0-1_all.deb