Bug 2278616 (CVE-2024-4418)
| Summary: | CVE-2024-4418 libvirt: stack use-after-free in virNetClientIOEventLoop() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ailan, berrange, ddepaula, eblake, jdenemar, jferlan, jmaloy, jsuchane, knoel, pkrempa, yalzhang, ymankad |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-09-29 05:27:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2278618 | ||
| Bug Blocks: | 2278620 | ||
|
Description
Mauro Matteo Cascella
2024-05-02 12:29:32 UTC
Red Hat would like to thank Martin Širokov for reporting this issue. Created libvirt tracking bugs for this issue: Affects: fedora-all [bug 2278618] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:4351 https://access.redhat.com/errata/RHSA-2024:4351 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:4432 https://access.redhat.com/errata/RHSA-2024:4432 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:4757 https://access.redhat.com/errata/RHSA-2024:4757 |