CVE-2024-4418 Libvirt: stack use-after-free in virnetclientioeventloop()
A race condition in libvirt allows local unprivileged users to bypass authentication and access virtproxyd, potentially escalating privileges if fine-grained access control is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4418?
CVE-2024-4418 is a medium-severity use after free vulnerability in Red Hat Enterprise Linux 6, published on 8 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.
Weakness: CWE-562
Which versions are affected by CVE-2024-4418?
Linux distribution packages (40)
SLOF AlmaLinux:8 | All versions | 20210217-2.module_el8.10.0+3768+dfd76e10 |
hivex AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+2880+7d9e3703 |
hivex AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+3161+a07c0ea5 |
hivex-devel AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+2880+7d9e3703 |
hivex-devel AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+3161+a07c0ea5 |
libguestfs AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-appliance AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-bash-completion AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-gfs2 AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-gobject AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-gobject-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-inspect-icons AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-java AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-java-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-javadoc AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-man-pages-ja AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-man-pages-uk AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-rescue AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-rsync AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-tools AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-tools-c AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-winsupport AlmaLinux:8 | All versions | 8.10-1.module_el8.10.0+3768+dfd76e10 |
libguestfs-xfs AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libiscsi AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libiscsi-devel AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi-devel AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libiscsi-utils AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi-utils AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libnbd AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+2880+7d9e3703 |
libnbd AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+3161+a07c0ea5 |
libnbd-bash-completion AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+2880+7d9e3703 |
libnbd-devel AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+2880+7d9e3703 |
libnbd-devel AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+3161+a07c0ea5 |
libtpms AlmaLinux:8 | All versions | 0.9.1-2.20211126git1ff6fe1f43.module_el8.9.0+3659+9c8643f3 |
libtpms-devel AlmaLinux:8 | All versions | 0.9.1-2.20211126git1ff6fe1f43.module_el8.9.0+3659+9c8643f3 |
libvirt AlmaLinux:8 | All versions | 8.0.0-23.2.module_el8.10.0+3867+f3f9981a |
libvirt-client AlmaLinux:8 | All versions | 8.0.0-23.2.module_el8.10.0+3867+f3f9981a |
libvirt-daemon AlmaLinux:8 | All versions | 8.0.0-23.2.module_el8.10.0+3867+f3f9981a |
How do I fix CVE-2024-4418?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-4418 being exploited?
There is no known exploitation of CVE-2024-4418 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:4351, ALSA-2024:4757, AZL-40396, AZL-40447, BELL-CVE-2024-4418, DEBIAN-CVE-2024-4418 and 12 more.