CVE-2024-2496 Libvirt: null pointer dereference in udevconnectlistallinterfaces()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Libvirt Vulnerabilities CVE-2024-2496 and CVE-2024-1441 Published Two vulnerabilities in Libvirt have been disclosed, affecting systems using this virtualization API. CVE-2024-2496 involves a null pointer dereference in the function udevconnectlistallinterfaces(), while CVE-2024-1441 is related to an off-by-one error in udevlistinterfacesbystatus(). Both vulnerabilities were published in March 2024. 2 sources 41