Integer Overflow Vulnerability in Keepalived Package - CVE-2024-41184
Summary
RLSA-2025:0743: Moderate: keepalived security update. Affects keepalived versions < 0:2.1.5-10.el8_10. Fixed in 0:2.1.5-10.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keepalived is a utility designed to provide robust load balancing and high availability for server pools. It utilizes the IP Virtual Server (IPVS) kernel module for layer-4 load balancing and implements the Virtual Router Redundancy Protocol (VRRPv2) for director failover. This makes it a critical component for maintaining service continuity and reliability in networked environments.
Vulnerability Detail
The vulnerability identified as CVE-2024-41184 is an integer overflow issue in the vrrp_ipsets_handler function of the Keepalived package. This flaw can potentially allow an attacker to exploit the overflow condition, leading to unexpected behavior, including denial of service or arbitrary code execution. The vulnerability arises from improper handling of input values, which can exceed the expected range, causing the application to behave unpredictably.
How To Fix
Minimum fixed version
0:2.1.5-10.el8_10
This is the first release that contains the fix.
sudo dnf update keepalivedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the Keepalived service or implement network-level controls to restrict unauthorized access until the package is updated. Additionally, monitoring logs for unusual activity can help identify potential exploitation attempts.
Conclusion
The integer overflow vulnerability in the Keepalived package poses significant risks to network availability and security. It is crucial for users to update to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for keepalived →
FAQ
CVE-2024-41184 is an integer overflow vulnerability found in the Keepalived package that could lead to denial of service or arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The risks include potential denial of service, unauthorized access, and arbitrary code execution, which can compromise the integrity and availability of services.
Yes, a patch is available. Users should update their Keepalived package to version 0:2.1.5-10.el8_10 or later.
If immediate updating is not possible, consider implementing network-level controls to restrict access and monitor logs for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for keepalived.
