CVE-2024-2494: 
Rocky Linux vulnerability analysis and mitigation

A vulnerability (CVE-2024-2494) was discovered in the RPC library APIs of libvirt, disclosed on March 21, 2024. The flaw exists in the RPC server deserialization code where memory allocation for arrays occurs before non-negative length checks are performed by the C API entry points (NVD).

The vulnerability occurs when passing a negative length to the g_new0 function, which results in a crash due to the negative length being treated as a huge positive number. The issue was found and diagnosed by ALT Linux Team using AFLplusplus. The vulnerability has been assigned a CVSS v3.1 base score of 6.2 (MEDIUM) with the vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Red Hat).

When successfully exploited, this vulnerability allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash (NVD).

The vulnerability requires local access and can be exploited by an unprivileged user. No user interaction is needed for exploitation. The vulnerability has been confirmed to be exploitable in real-world conditions (Red Hat).

The vulnerability has been fixed in upstream libvirt with commit 8a3f8d957507c1f8223fdcf25a3ff885b15557f2. Red Hat has released security updates through RHSA-2024:2560 for RHEL 9 and RHSA-2024:3253 for RHEL 8. Users are advised to update their libvirt packages to the patched versions (Libvirt List).