CVE-2024-2496: 
NixOS vulnerability analysis and mitigation

CVE-2024-2496 is a NULL pointer dereference vulnerability discovered in the udevConnectListAllInterfaces() function of libvirt. The vulnerability was disclosed on March 18, 2024, and affects the libvirt virtualization toolkit. This security flaw occurs when detaching a host interface while simultaneously collecting the list of interfaces via virConnectListAllInterfaces API (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.0 (Medium) and vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H. The issue specifically manifests in the udevConnectListAllInterfaces() function when concurrent operations involving interface detachment and listing are performed (Red Hat CVE).

The vulnerability can be exploited to perform a denial of service attack by causing the libvirt daemon to crash. This impact affects system availability and could disrupt virtualization operations managed by libvirt (NVD).

The vulnerability requires local access and can be triggered by an attacker with limited privileges. The exploit involves concurrent operations: detaching a host interface while simultaneously collecting interface lists through the virConnectListAllInterfaces API (Red Hat CVE).

Red Hat has released security updates to address this vulnerability in Red Hat Enterprise Linux 9 through RHSA-2024:2236. The fix involves updating to libvirt version 10.0.0-6.el9_4. After installing the updated packages, libvirtd will be restarted automatically (Red Hat Advisory).