ALT-PU-2024-3875-1
Package libvirt updated to version 9.8.0-alt4 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2024-03-11
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2024-1441
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
References:
- RHSA-2024:2560
- RHSA-2024:2560
- https://access.redhat.com/security/cve/CVE-2024-1441
- https://access.redhat.com/security/cve/CVE-2024-1441
- RHBZ#2263841
- RHBZ#2263841
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45FFKU3LODT345LAB5T4XZA5WKYMXJYU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6MVZO5GXDB7RHY6MS3ZXES3HPK34P3A/