CVE-2024-1441: libvirt Off-by-one Error
Vulnerability summary
CVE-2024-1441 is a medium (CVSS 5.5) Off-by-one Error vulnerability in libvirt. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 11-03-2024PublishedVulnerability first disclosed.
- 08-11-2025Last modifiedVulnerability information updated.
Description
An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libvirt< 9.0.0-4+deb12u1 | < 10.1.0-1
Opensuse1 product
- libvirt&distro=openSUSE Tumbleweed< 10.1.0-1.1
Ubuntu1 product
- libvirt< 1.2.2-0ubuntu13.1.28+esm2 | < 1.3.1-1ubuntu10.31+esm1 | < 4.0.0-1ubuntu8.21+esm1 | < 6.0.0-0ubuntu8.19 | < 8.0.0-1ubuntu7.10 | < 10.0.0-2ubuntu8.1
3 vendors · 3 products
References
15 links
- lists.fedoraproject.org/archives/…X Transferred
- lists.fedoraproject.org/archives/…X Transferred
