CVE-2024-1441

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.(CVE-2024-1441)

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.(CVE-2024-2494)

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.

Security Fix(es):

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.(CVE-2024-1441)

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.(CVE-2024-2494)

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fixes:

• libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441)
• libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes:

• libvirt: off-by-one error in udevListInterfacesByStatus() [almalinux-9] (JIRA:AlmaLinux-25081)
• libvirt: negative g_new0 length can lead to unbounded memory allocation [almalinux-9] (JIRA:AlmaLinux-29515)

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.

An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.

• CVE-2024-1441: fix off-by-one error in udevListInterfacesByStatus
• CVE-2024-2494: check for negative array lengths before allocation in remote_daemon_dispatch

• CVE-2021-3631: Fix insecure sVirt label generation (single-category MCS labels) in virSecuritySELinuxMCSFind()
• CVE-2021-3975: Fix use-after-free due to missing monitor lock in qemuProcessHandleMonitorEOF()
• CVE-2022-0897: Fix missing locking in nwfilterConnectNumOfNWFilters() (DoS)
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus()
• Fix udev device reference leak on NULL interface names in udevListInterfacesByStatus() and udevConnectListAllInterfaces()

• CVE-2021-3631: Fix insecure sVirt label generation (single-category MCS labels) in virSecuritySELinuxMCSFind()
• CVE-2021-3975: Fix use-after-free due to missing monitor lock in qemuProcessHandleMonitorEOF()
• CVE-2022-0897: Fix missing locking in nwfilterConnectNumOfNWFilters() (DoS)
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus()
• Fix udev device reference leak on NULL interface names in udevListInterfacesByStatus() and udevConnectListAllInterfaces()

These are all security issues fixed in the libvirt-10.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fixes:

• libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441)

• libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes:

• libvirt: off-by-one error in udevListInterfacesByStatus() [rhel-9] (JIRA:Rocky Linux-25081)

• libvirt: negative g_new0 length can lead to unbounded memory allocation [rhel-9] (JIRA:Rocky Linux-29515)

This update for libvirt fixes the following issues:

• CVE-2024-2496: Fixed NULL pointer dereference in udevConnectListAllInterfaces() (bsc#1221468).
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus (bsc#1221237)

This update for libvirt fixes the following issues:

• CVE-2024-2494: Add a check for negative array lengths before allocation to prevent potential DoS. (bsc#1221815)
• CVE-2024-2496: Fixed NULL pointer dereference in udevConnectListAllInterfaces() (bsc#1221468).
• CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus (bsc#1221237)
• qemu: domain: Fix logic when tainting domain (bsc#1220512)
• conf: Remove some firmware validation checks (bsc#1216980)
• libxl: Fix connection to modular network daemon (bsc#1214223)

Alexander Kuznetsov discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-1441)

It was discovered that libvirt incorrectly handled certain RPC library API calls. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-2494)

It was discovered that libvirt incorrectly handled detaching certain host interfaces. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-2496)

USN-6734-1 fixed vulnerabilities in libvirt. This update provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

Alexander Kuznetsov discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-1441)

It was discovered that libvirt incorrectly handled certain RPC library API calls. An attacker could possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-2494)

It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)

Alexander Kuznetsov discovered that libvirt incorrectly handled listing network interfaces. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-1441)

It was discovered that libvirt incorrectly handled certain values in its RPC library. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-2494)

It was discovered that libvirt incorrectly handled listing network interfaces under certain circumstances. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-2496)

It was discovered that libvirt incorrectly set permissions on external inactive snapshots, making them world-readable. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-13193)

It was discovered that libvirt incorrectly handled certain characters in virtual network definitions. An authenticated user could possibly use this issue to inject arbitrary configuration directives and execute arbitrary code as root. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61477)

It was discovered that libvirt incorrectly handled certain XML input. An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. (CVE-2026-61478)

He Wei discovered that libvirt incorrectly followed symbolic links when changing file ownership. A local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)

It was discovered that libvirt incorrectly set permissions on images during storage volume clone and convert operations, making them temporarily world-readable. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-63623)