A flaw was found in the RPC library APIs of libvirt. (CVE-2024-2494)
A vulnerability in the RPC library APIs of libvirt allows a local, unprivileged user to cause a denial of service by crashing the libvirt daemon. The issue arises because the RPC server deserialization code allocates memory for arrays before validating that the length is non-negative. Passing a negative length to the g_new0 function leads to a crash due to an unbounded memory allocation attempt. This flaw affects multiple versions of libvirt and has been assigned CVE-2024-2494 with a CVSS score of 6.2 (medium severity). Official patches are available from Red Hat and Ubuntu to address this issue.
AI Analysis
Technical Summary
CVE-2024-2494 is a denial of service vulnerability in libvirt's RPC library APIs. The flaw occurs because the RPC server deserialization code allocates memory for arrays before performing a non-negative length check. If a negative length is passed to the g_new0 function, it is interpreted as a very large positive number, causing a crash due to unbounded memory allocation. This allows a local, unprivileged attacker to crash the libvirt daemon, resulting in denial of service. The vulnerability affects various versions of libvirt, including those in Red Hat Enterprise Linux 8 and Ubuntu 20.04, 22.04, and 23.10 releases. Patches have been released by both Red Hat and Ubuntu to fix the issue.
Potential Impact
The vulnerability allows a local, unprivileged user to cause a denial of service by crashing the libvirt daemon. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported.
Mitigation Recommendations
Official patches are available and should be applied to affected systems. Red Hat has released updates for Red Hat Enterprise Linux 8 and related modules, and Ubuntu has released fixed package versions for Ubuntu 20.04 LTS, 22.04 LTS, and 23.10. Users should update libvirt packages to the patched versions and reboot the system to complete remediation. Patch status is confirmed by vendor advisories.
A flaw was found in the RPC library APIs of libvirt. (CVE-2024-2494)
Description
A vulnerability in the RPC library APIs of libvirt allows a local, unprivileged user to cause a denial of service by crashing the libvirt daemon. The issue arises because the RPC server deserialization code allocates memory for arrays before validating that the length is non-negative. Passing a negative length to the g_new0 function leads to a crash due to an unbounded memory allocation attempt. This flaw affects multiple versions of libvirt and has been assigned CVE-2024-2494 with a CVSS score of 6.2 (medium severity). Official patches are available from Red Hat and Ubuntu to address this issue.
CVSS v3.1
Score 6.2medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-2494 is a denial of service vulnerability in libvirt's RPC library APIs. The flaw occurs because the RPC server deserialization code allocates memory for arrays before performing a non-negative length check. If a negative length is passed to the g_new0 function, it is interpreted as a very large positive number, causing a crash due to unbounded memory allocation. This allows a local, unprivileged attacker to crash the libvirt daemon, resulting in denial of service. The vulnerability affects various versions of libvirt, including those in Red Hat Enterprise Linux 8 and Ubuntu 20.04, 22.04, and 23.10 releases. Patches have been released by both Red Hat and Ubuntu to fix the issue.
Potential Impact
The vulnerability allows a local, unprivileged user to cause a denial of service by crashing the libvirt daemon. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported.
Mitigation Recommendations
Official patches are available and should be applied to affected systems. Red Hat has released updates for Red Hat Enterprise Linux 8 and related modules, and Ubuntu has released fixed package versions for Ubuntu 20.04 LTS, 22.04 LTS, and 23.10. Users should update libvirt packages to the patched versions and reboot the system to complete remediation. Patch status is confirmed by vendor advisories.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:3253
- Cve Count
- 1
Threat ID: 6a419cc027e9c79719ac08c2
Added to database: 06/28/2026, 22:14:24 UTC
Last enriched: 08/20/2026, 16:55:20 UTC
Last updated: 09/10/2026, 22:24:51 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.