Libvirt Security Notice: LSN-2024-0004

NULL pointer dereference when 0 length array of interfaces is requested

Lifecycle

Reported on: 20240821
Published on: 20240829
Fixed on: 20240829

Credits

Reported by: Yanqiu Zhang
Patched by: Peter Krempa

See also

Description

A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced.

Impact

Unprivileged clients can crash virtinterfaced via a read-only connection

Workaround

None

Affected product: libvirt

Branch: master

Broken in:
v10.4.0
v10.5.0
v10.6.0
Fixed in:
v10.7.0
Broken by:
bc596f275129bc11b2c4bcf737d380c9e8aeb72d
Fixed by:
8dfb12cb77996519901b8d52c754ab564ebd10e8

Alternative formats: [xml] [text]