ALT-PU-2024-6255-1
Package libvirt updated to version 10.2.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2024-03-11
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2024-1441
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
References:
- RHSA-2024:2560
- RHSA-2024:2560
- https://access.redhat.com/security/cve/CVE-2024-1441
- https://access.redhat.com/security/cve/CVE-2024-1441
- RHBZ#2263841
- RHBZ#2263841
- https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45FFKU3LODT345LAB5T4XZA5WKYMXJYU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6MVZO5GXDB7RHY6MS3ZXES3HPK34P3A/
- https://security.netapp.com/advisory/ntap-20250411-0003/