Libvirt: negative g_new0 length can lead to unbounded memory allocation
Summary
| CVE | CVE-2024-2494 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-03-21 14:15:10 UTC |
| Updated | 2026-11-05 13:17:00 UTC |
| Description | A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash. |
Risk And Classification
Primary CVSS: v3.1 6.2 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003670000 probability, percentile 0.307040000 (date 2026-11-05)
Problem Types: CWE-789 | CWE-789 Memory Allocation with Excessive Size Value
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 6.2 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020240409073027.489197e6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020240409073027.489197e6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:10.0.0-6.2.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 Advanced Virtualization | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.netapp.com/advisory/ntap-20240517-0009 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2024:3253 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.libvirt.org/archives/list/[email protected]/thread/BKRQXPLPC6B7FLHJ... | af854a3a-2127-422b-91ae-364da2661108 | lists.libvirt.org | |
| access.redhat.com/security/cve/CVE-2024-2494 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2560 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.debian.org/debian-lts-announce/2024/04/msg00000.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Alexander Kuznetsov (ALT Linux Team) for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-03-18T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-03-21T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 6000552 Debian Security Update for libvirt (DLA 3778-1)
- 756043 SUSE Enterprise Linux Security Update for libvirt (SUSE-SU-2024:1078-1)
- 756044 SUSE Enterprise Linux Security Update for libvirt (SUSE-SU-2024:1083-1)
- 756069 SUSE Enterprise Linux Security Update for libvirt (SUSE-SU-2024:1100-1)
- 756087 SUSE Enterprise Linux Security Update for libvirt (SUSE-SU-2024:1099-1)