CVE-2024-2494

Name	CVE-2024-2494
Description	A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3778-1
Debian Bugs	1067461

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libvirt (PTS)	bullseye	7.0.0-3+deb11u3	fixed
	bookworm	9.0.0-4+deb12u2	fixed
	sid, trixie	10.9.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libvirt	source	buster	5.0.0-4+deb10u2	DLA-3778-1
libvirt	source	bullseye	7.0.0-3+deb11u3
libvirt	source	bookworm	9.0.0-4+deb12u1
libvirt	source	(unstable)	10.2.0-1		1067461

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2270115
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/BKRQXPLPC6B7FLHJXSBQYW7HNDEBW6RJ/
Fixed by: https://gitlab.com/libvirt/libvirt/-/commit/8a3f8d957507c1f8223fdcf25a3ff885b15557f2 (v10.2.0-rc1)