Moderate: libvirt security and bug fix update
Summary
ALSA-2024:2560: Moderate: libvirt security and bug fix update. Affects libvirt versions < 10.0.0-6.2.el9_4.alma.1. Fixed in 10.0.0-6.2.el9_4.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libvirt library is a C API for managing and interacting with virtualization capabilities on Linux and other operating systems. It also provides tools for remote management of virtualized systems.
Vulnerability Detail
This update addresses two security vulnerabilities in libvirt:
-
CVE-2024-1441: An off-by-one error in the udevListInterfacesByStatus() function could lead to a buffer overflow, potentially allowing an attacker to execute arbitrary code or crash the application.
-
CVE-2024-2494: A negative length value in the g_new0 function could result in unbounded memory allocation, leading to a denial of service or potential code execution.
How To Fix
Minimum fixed version
10.0.0-6.2.el9_4.alma.1
This is the first release that contains the fix.
sudo dnf update libvirtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses two security vulnerabilities in the libvirt library. It is recommended to update the libvirt package to version 10.0.0-6.2.el9_4.alma.1 or later to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libvirt →
FAQ
Libvirt is a C API for managing virtualization capabilities on Linux and other operating systems. It provides tools for remote management of virtualized systems.
CVE-2024-1441 is an off-by-one error in the udevListInterfacesByStatus() function of libvirt. It could allow an attacker to execute arbitrary code or crash the application.
CVE-2024-2494 is a vulnerability in libvirt that could result in unbounded memory allocation due to a negative length value in the g_new0 function. This could lead to a denial of service or potential code execution.
To fix these vulnerabilities, update the libvirt package to version 10.0.0-6.2.el9_4.alma.1 or later.
There is no specific workaround mentioned for these vulnerabilities. It is recommended to update the libvirt package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for libvirt.
