Libvirt Security Notice: LSN-2024-0004
        ======================================

       Summary: NULL pointer dereference when 0 length array of
                interfaces is requested
   Reported on: 20240821
  Published on: 20240829
      Fixed on: 20240829
   Reported by: Yanqiu Zhang <yanqzhan@redhat.com>
    Patched by: Peter Krempa <pkrempa@redhat.com>
      See also: CVE-2024-8235

Description
-----------

A refactor of the code fetching the list of interfaces for multiple
APIs introduced a corner case on platforms where allocating 0 bytes
of memory results in a NULL pointer. This corner case would lead to
a NULL-pointer dereference and subsequent crash of virtinterfaced.

Impact
------

Unprivileged clients can crash virtinterfaced via a read-only
connection

Workaround
----------

None

Affected product
----------------

        Name: libvirt
  Repository: https://gitlab.com/libvirt/libvirt

      Branch: master
   Broken in: v10.4.0
   Broken in: v10.5.0
   Broken in: v10.6.0
    Fixed in: v10.7.0
   Broken by: bc596f275129bc11b2c4bcf737d380c9e8aeb72d
    Fixed by: 8dfb12cb77996519901b8d52c754ab564ebd10e8