CVE-2024-8235: A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0…

PriorityP422medium6.2CVSS 3.1

AVLACLPRNUINSUCNINAH

EPSS

0.24%

15.3th percentile

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	libvirt	< libvirt 10.7.0-1 (forky)	libvirt 10.7.0-1 (forky)
redhat	libvirt	>= 0 < 10.7.0-1	10.7.0-1
redhat	libvirt	>= 0 < 10.7.0-1	10.7.0-1
redhat	libvirt	>= 10.4.0 < 10.7.0	10.7.0

CVSS provenance

nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv6.2MEDIUM

vendor_debian6.2LOW

vendor_redhat6.2MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.