CVE-2024-2496

Medium

Description

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

SeverityMedium

CVSS5.0

Exploit probability—

Product

Redhat Libvirt

PublishedMar 18, 2024

First seenMar 18, 2024

Weakness typeCWE-476NULL pointer dereference

How to fix

Update

redhat libvirt9.8.0 or later

Patches

bugzilla.redhat.com/show_bug.cgi?id=2269672

Vendor advisories

access.redhat.com/errata/RHSA-2024:2236

Affected products

Product	Affected versions	Fixed in
redhat libvirt	v < 9.8.0	9.8.0
redhat enterprise_linux	6.0, 7.0, 8.0, 9.0	—
debian debian_linux	10.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.