Skip to content
Fencer Vulns
medium 6.2

CVE-2024-2494 json

Libvirt: negative g_new0 length can lead to unbounded memory allocation

published 2024-03-21 2 y ago modified 2026-11-05 3 d ago also EUVD-2024-27443

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits
0
none known

Summary

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 8100020240409073027.489197e6
  • Red Hat Red Hat Enterprise Linux 9 0:10.0.0-6.2.el9_4
  • libvirt Debian 12 9.0.0-4+deb12u1
  • libvirt Debian 14, Debian 13 10.2.0-1

debian advisories DEBIAN-CVE-2024-2494

  • libvirt Ubuntu 20.04 LTS 6.0.0-0ubuntu8.19
  • libvirt Ubuntu 22.04 LTS 8.0.0-1ubuntu7.10
  • libvirt Ubuntu 24.04 LTS 10.0.0-2ubuntu8.1
  • libvirt Ubuntu Pro 14.04 LTS 1.2.2-0ubuntu13.1.28+esm2
  • libvirt Ubuntu Pro 16.04 LTS 1.3.1-1ubuntu10.31+esm1
  • libvirt Ubuntu Pro 18.04 LTS 4.0.0-1ubuntu8.21+esm1

ubuntu advisories UBUNTU-CVE-2024-2494

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • SLOF RHEL 8 20210217-2.module+el8.10.0+20141+6faa2812
  • hivex RHEL 8 1.3.18-23.module+el8.9.0+18724+20190c23
  • netcf RHEL 8 0.2.8-12.module+el8.9.0+18724+20190c23
  • swtpm RHEL 8 0.7.0-4.20211109gitb79fd91.module+el8.9.0+18724+20190c23
  • libnbd RHEL 8 1.6.0-5.module+el8.9.0+18724+20190c23
  • nbdkit RHEL 8 1.24.0-5.module+el8.9.0+18724+20190c23
  • libtpms RHEL 8 0.9.1-2.20211126git1ff6fe1f43.module+el8.9.0+18724+20190c23
  • libvirt RHEL 8 8.0.0-23.1.module+el8.10.0+21659+98b2ad6a

red hat advisories RHSA-2024:3253RHSA-2024:2560

  • libvirt SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +7 more 8.0.0-150400.7.11.2
  • libvirt SLE Module for Server Applications 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +1 more 9.0.0-150500.6.20.1
  • libvirt SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 5.1.0-13.42.1
  • libvirt SLE Module for Server Applications 15 SP5, SLE Micro 5.2, SLE Micro 5.1 7.1.0-150300.6.41.1

suse advisories SUSE-SU-2024:1100-1SUSE-SU-2024:1099-1SUSE-SU-2024:1083-1SUSE-SU-2024:1078-1

  • libvirt openSUSE Tumbleweed 10.1.0-2.1

opensuse advisories openSUSE-SU-2024:13796-1

  • libvirt AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-nss AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-libs AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-client AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-daemon AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-daemon-kvm AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-daemon-log AlmaLinux 9 10.0.0-6.2.el9_4.alma.1
  • libvirt-client-qemu AlmaLinux 9 10.0.0-6.2.el9_4.alma.1

almalinux advisories ALSA-2024:2560

  • hivex Rocky Linux 8 1.3.18-23.module+el8.10.0+1590+a67ab969
  • netcf Rocky Linux 8 0.2.8-12.module+el8.10.0+1590+a67ab969
  • swtpm Rocky Linux 8 0.7.0-4.20211109gitb79fd91.module+el8.10.0+1590+a67ab969
  • libnbd Rocky Linux 8 1.6.0-5.module+el8.10.0+1590+a67ab969
  • nbdkit Rocky Linux 8 1.24.0-5.module+el8.10.0+1590+a67ab969
  • libtpms Rocky Linux 8 0.9.1-2.20211126git1ff6fe1f43.module+el8.10.0+1590+a67ab969
  • libvirt Rocky Linux 8 8.0.0-23.1.module+el8.10.0+1779+84732956
  • seabios Rocky Linux 8 1.16.0-4.module+el8.9.0+1408+7b966129

rocky linux advisories RLSA-2024:3253RLSA-2024:2560

  • libvirt CBL-Mariner 2.0 7.10.0-9
  • libvirt Azure Linux 3.0 10.0.0-4

azure linux advisories AZL-37110AZL-38665

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-2494 updated cvss 6.2

libvirt: negative g_new0 length can lead to unbounded memory allocation

  • Red Hat Enterprise Linux 6 libvirt, libvirt-client, libvirt-python, libvirt-lock-sanlock Red Hat Enterprise Linux 7 libvirt, libvirt-nss, libvirt-libs, libvirt-admin, libvirt-client, libvirt-daemon, +24 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 Advanced Virtualization libvirt, libvirt-nss, libvirt-libs, libvirt-admin, libvirt-client, libvirt-daemon, +22 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) libnbd 1.6.0-5.module+el8.9.0+18724+20190c23, netcf 0.2.8-12.module+el8.9.0+18724+20190c23, hivex 1.3.18-23.module+el8.9.0+18724+20190c23, nbdfuse 1.6.0-5.module+el8.9.0+18724+20190c23, nbdkit 1.24.0-5.module+el8.9.0+18724+20190c23, seabios 1.16.0-4.module+el8.9.0+19570+14a90618, +104 more
    fixed: vendor fix RHSA-2024:3253
  • Red Hat Enterprise Linux AppStream (v. 9) libvirt 10.0.0-6.2.el9_4, libvirt-nss 10.0.0-6.2.el9_4, libvirt-libs 10.0.0-6.2.el9_4, libvirt-client 10.0.0-6.2.el9_4, libvirt-daemon 10.0.0-6.2.el9_4, libvirt-daemon-kvm 10.0.0-6.2.el9_4, +22 more
    fixed: vendor fix RHSA-2024:2560
  • Red Hat Enterprise Linux CRB (v. 8) libnbd 1.6.0-5.module+el8.9.0+18724+20190c23, netcf 0.2.8-12.module+el8.9.0+18724+20190c23, hivex 1.3.18-23.module+el8.9.0+18724+20190c23, nbdfuse 1.6.0-5.module+el8.9.0+18724+20190c23, seabios 1.16.0-4.module+el8.9.0+19570+14a90618, SLOF 20210217-2.module+el8.10.0+20141+6faa2812, +38 more
    fixed: vendor fix RHSA-2024:3253
  • Red Hat Enterprise Linux CRB (v. 9) libvirt-daemon-plugin-sanlock 10.0.0-6.2.el9_4
    fixed: vendor fix RHSA-2024:2560

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8 Advanced Virtualization

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.