libvirt: zero-byte allocation corner case lets read-only clients crash virtinterfaced

CVSS 6.2CVE-2024-8235Kernel, userspace & hypervisorcurated

Impact

A refactor of the code that fetches the host interface list introduced a corner case on platforms where a zero-byte allocation returns NULL, leading to a NULL-pointer dereference and a crash of virtinterfaced. Clients connected to the read-only socket are enough to trigger it, so the usual assumption that read-only libvirt access is harmless does not hold here. The blast radius is narrower than a libvirtd crash: it is the host interface-management daemon, so inventory and interface configuration calls fail on that host. On GPU nodes where tooling polls interface state - fabric inventory, RoCE or bonded-NIC checks - that polling breaks until the daemon is restarted. No guest or data-path impact is described.

Who can reach it

Any client able to open libvirt's read-only socket on the host, which in default configurations includes local unprivileged users. No authentication required for read-only access.

What to do

Update libvirt via RHSA-2024:9128 (or your distribution's equivalent) and restart virtinterfaced. Running guests are unaffected, so this is a per-host daemon restart; no drain or reboot. If virtinterfaced is not in use, leaving it disabled avoids the exposure.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-8235 https://access.redhat.com/security/cve/CVE-2024-8235 https://access.redhat.com/errata/RHSA-2024:9128 https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/X6WOVCL6QF3FQRFIIXL736RFZVSUWLWJ/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.