virt:av/libvirt vulnerabilities
CVEs whose affected-version data names the virt:av/libvirt package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2024-8235Medium· 6.2Libvirt: crash of virtinterfaced via virconnectlistinterfaces()
A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NU…
CVE-2024-4418Medium· 6.2Libvirt: stack use-after-free in virnetclientioeventloop()
A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used …
CVE-2024-2494Medium· 6.2Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 fun…
CVE-2024-2496Medium· 5.0Libvirt: null pointer dereference in udevconnectlistallinterfaces()
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInter…
CVE-2024-1441Medium· 5.5PoCLibvirt: off-by-one error in udevlistinterfacesbystatus()
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt…
CVE-2023-3750Medium· 6.5Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service
A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue …