Vulnerability record/PUBLISHED/Published Mar 11, 2024 13:37:54 UTC
CVE-2024-1441
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
Base score5.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorLocalAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactNoneI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 5, 2026 11:43:54 UTC
PublishedMar 11, 2024 13:37:54 UTC
ReservedFeb 12, 2024 11:47:40 UTC
Credits
- Red Hat would like to thank Alexander Kuznetsov for reporting this issue.