Vulnerabilities > CVE-2024-8235 - NULL Pointer Dereference vulnerability in Redhat Libvirt 10.4.0/10.5.0/10.6.0

047910
CVSS 6.2 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
local
low complexity
redhat
CWE-476
NVD
Published: 2024-08-30
Updated: 2024-11-21

Summary

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

Vulnerable Configurations

Part Description Count
Application
Redhat
8
OS
Redhat
1

Common Weakness Enumeration (CWE)

References