CVE-2024-2494

2024-03-2000:00:00

ubuntu.com

libvirt

rpc

denial of service

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.3%

JSON

A flaw was found in the RPC library APIs of libvirt. The RPC server
deserialization code allocates memory for arrays before the non-negative
length check is performed by the C API entry points. Passing a negative
length to the g_new0 function results in a crash due to the negative length
being treated as a huge positive number. This flaw allows a local,
unprivileged user to perform a denial of service attack by causing the
libvirt daemon to crash.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlibvirt< anyUNKNOWN
ubuntu20.04noarchlibvirt< 6.0.0-0ubuntu8.19UNKNOWN
ubuntu22.04noarchlibvirt< 8.0.0-1ubuntu7.10UNKNOWN
ubuntu23.10noarchlibvirt< 9.6.0-1ubuntu1.1UNKNOWN
ubuntu24.04noarchlibvirt< 10.0.0-2ubuntu8.1UNKNOWN
ubuntu14.04noarchlibvirt< anyUNKNOWN
ubuntu16.04noarchlibvirt< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	libvirt	< any	UNKNOWN
ubuntu	20.04	noarch	libvirt	< 6.0.0-0ubuntu8.19	UNKNOWN
ubuntu	22.04	noarch	libvirt	< 8.0.0-1ubuntu7.10	UNKNOWN
ubuntu	23.10	noarch	libvirt	< 9.6.0-1ubuntu1.1	UNKNOWN
ubuntu	24.04	noarch	libvirt	< 10.0.0-2ubuntu8.1	UNKNOWN
ubuntu	14.04	noarch	libvirt	< any	UNKNOWN
ubuntu	16.04	noarch	libvirt	< any	UNKNOWN