Riskcovery

CVE-2024-2494

Libvirt: negative g_new0 length can lead to unbounded memory allocation

State
Published
Severity
6.2 Medium
Published
Mar 21, 2024
Updated
Feb 25, 2026
Reserved
Mar 15, 2024

Read the record on cve.org

Description

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.

Scores

CVSSScoreVectorSource
3.16.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-789 Memory Allocation with Excessive Size Value

Affected Products

ProductVersions
libvirt
  • 9.0.0 to before 9.7.0Affected
Red Hat Enterprise Linux 8Red Hat
  • 8100020240409073027.489197e6 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 8100020240409073027.489197e6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:10.0.0-6.2.el9_4 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat
      Red Hat Enterprise Linux 8 Advanced VirtualizationRed Hat

        References

        Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.