CVE-2024-8235CWE-476

Libvirt: crash of virtinterfaced via virconnectlistinterfaces()

Medium · published August 30, 2024

CVSS v3.1
6.2
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2024-08-30T16:16Z
EPSS history
Timeline
  • 30 AUG 16:16Z
    Libvirt: crash of virtinterfaced via virconnectlistinterfaces()
    cvelistv5