CVE-2024-4418 — Return of Stack Variable Address

Vendor	Product	Version range	Fixed in
debian	libvirt	< libvirt 10.3.0-1 (forky)	libvirt 10.3.0-1 (forky)
msrc	azl3_libvirt_10.0.0-5_on_azure_linux_3.0	—	—
msrc	cbl2_libvirt_7.10.0-10_on_cbl_mariner_2.0	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
redhat	libvirt	>= 0 < 10.3.0-1	10.3.0-1
redhat	libvirt	>= 0 < 10.3.0-1	10.3.0-1

OSV

CVE-2024-4418: A race condition leading to a stack use-after-free flaw was found in libvirt

osv·2024-05-08·CVSS 6.2

CVE-2024-4418 [MEDIUM] CVE-2024-4418: A race condition leading to a stack use-after-free flaw was found in libvirt A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.

GHSA

GHSA-q262-3hfr-f5q4: A race condition leading to a stack use-after-free flaw was found in libvirt

ghsa_unreviewed·2024-05-08

CVE-2024-4418 [MEDIUM] CWE-416 GHSA-q262-3hfr-f5q4: A race condition leading to a stack use-after-free flaw was found in libvirt A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.

Microsoft

Libvirt: stack use-after-free in virnetclientioeventloop()

vendor_msrc·2024-05-14·CVSS 6.2

CVE-2024-4418 [MEDIUM] CWE-416 Libvirt: stack use-after-free in virnetclientioeventloop() Libvirt: stack use-after-free in virnetclientioeventloop() FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this. Mariner: Mariner redhat: redhat Customer Action Required: Yes Remediation: CBL-Mariner Releases Reference: https://

Ubuntu

libvirt vulnerability

vendor_ubuntu·2024-05-07

CVE-2024-4418 libvirt vulnerability Title: libvirt vulnerability Summary: libvirt could allow unintended access to the virtproxyd service. Martin Širokov discovered that libvirt incorrectly handled certain memory operations. A local attacker could possibly use this issue to access virtproxyd without authorization. Instructions: After a standard system update you need to reboot your computer to make all the necessary changes.

Red Hat

libvirt: stack use-after-free in virNetClientIOEventLoop()

vendor_redhat·2024-05-02·CVSS 6.2

CVE-2024-4418 [MEDIUM] CWE-562 libvirt: stack use-after-free in virNetClientIOEventLoop() libvirt: stack use-after-free in virNetClientIOEventLoop() A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access i

Debian

CVE-2024-4418: libvirt - A race condition leading to a stack use-after-free flaw was found in libvirt. Du...

vendor_debian·2024·CVSS 6.2

CVE-2024-4418 [MEDIUM] CVE-2024-4418: libvirt - A race condition leading to a stack use-after-free flaw was found in libvirt. Du... A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it. Scope: local bookworm: resolved bullseye: resolved forky:

CVE-2024-4418: A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data`…

Affected

CVSS provenance