ALT Linux Team

Branch c10f1 update on 2024-04-02

2024-04-02

ALT-BU-2024-4861-1

Branch c10f1 update bulletin.

ALT-PU-2024-4681-2

Package libvirt updated to version 9.7.0-alt2.p10.2 for branch c10f1 in task 343808.

Closed vulnerabilities

Published: 2024-03-21
Modified: 2024-11-21

CVE-2024-2494

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.

References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top