A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.
CVE-2024-8235
CVSS base score
6.2 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-476
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
redhat libvirt
References
- access.redhat.com
- access.redhat.com Vendor Advisory
- bugzilla.redhat.com Issue Tracking, Vendor Advisory
- lists.libvirt.org Patch, Third Party Advisory
- security.netapp.com