What’s Vulnerable › Vulnerabilities

CVE-2024-4418: Libvirt: stack use-after-free in virnetclientioeventloop()

• Severity: medium (CVSS 6.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-08 · updated 2026-06-17
• Weakness: CWE-562

Description

A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while the data pointer's stack frame was concurrently being "freed" when returning from virNetClientIOEventLoop(). The 'virtproxyd' daemon can be used to trigger requests. If libvirt is configured with fine-grained access control, this issue, in theory, allows a user to escape their otherwise limited access. This flaw allows a local, unprivileged user to access virtproxyd without authenticating. Remote users would need to authenticate before they could access it.

Affected products

• Red Hat Enterprise Linux 8: all versions — fixed in 8100020240606142719.489197e6
• Red Hat Enterprise Linux 8 Advanced Virtualization: all versions
• Red Hat Enterprise Linux 9: all versions — fixed in 0:10.0.0-6.6.el9_4
• Red Hat Enterprise Linux 9.2 Extended Update Support: all versions — fixed in 0:9.0.0-10.7.el9_2

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 8 8100020240606142719.489197e6; Red Hat Enterprise Linux 9 0:10.0.0-6.6.el9_4; Red Hat Enterprise Linux 9.2 Extended Update Support 0:9.0.0-10.7.el9_2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:4351
• https://access.redhat.com/errata/RHSA-2024:4432
• https://access.redhat.com/errata/RHSA-2024:4757
• https://access.redhat.com/security/cve/CVE-2024-4418
• https://bugzilla.redhat.com/show_bug.cgi?id=2278616
• https://access.redhat.com/errata/RHSA-2024:4351
• https://access.redhat.com/errata/RHSA-2024:4432
• https://access.redhat.com/errata/RHSA-2024:4757
• https://access.redhat.com/security/cve/CVE-2024-4418
• https://bugzilla.redhat.com/show_bug.cgi?id=2278616
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4IE44UIIC3QWBFRB4EUSFNLJBU6JLNSD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4ZQBAJVHIZMCZNTRPUW3ZKXRKLXRQZU/

Get alerted when CVE-2024-4418 or the next vulnerability affects your stack