CVE-2024-8235
published 2024-08-30CVE-2024-8235: A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0…
medium6.2CVSS 3.1
AVLACLPRNUINSUCNINAH
A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libvirt | < libvirt 10.7.0-1 (forky) | libvirt 10.7.0-1 (forky) |
| redhat | libvirt | >= 0 < 10.7.0-1 | 10.7.0-1 |
| redhat | libvirt | >= 0 < 10.7.0-1 | 10.7.0-1 |
| redhat | libvirt | >= 10.4.0 < 10.7.0 | 10.7.0 |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv6.2MEDIUM