CVE-2024-2496: debian debian_linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumAnalyzed

AliasesMGASA-2024-0163RHSA-2024:2236UBUNTU-CVE-2024-2496+1 more

Published 18-03-2024Last modified 08-11-2025

Vulnerability summary

CVE-2024-2496 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.7% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 4

DLA-3778-1 SUSE-SU-2024:1005-1 SUSE-SU-2024:1099-1 USN-6734-1 USN-8652-1

Timeline

18-03-2024
PublishedVulnerability first disclosed.
08-11-2025
Last modifiedVulnerability information updated.

Description

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

CVSS metrics

5 scores · 5 sources · 1 version

v3.15.5

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

16%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Redhat59 products

enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0
libvirt< 9.8.0
libvirt< 0:10.0.0-6.el9_4
libvirt-client< 0:10.0.0-6.el9_4
libvirt-client-debuginfo< 0:10.0.0-6.el9_4

libvirt-client-qemu< 0:10.0.0-6.el9_4
libvirt-daemon< 0:10.0.0-6.el9_4
libvirt-daemon-common< 0:10.0.0-6.el9_4
libvirt-daemon-common-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-config-network< 0:10.0.0-6.el9_4
libvirt-daemon-config-nwfilter< 0:10.0.0-6.el9_4
libvirt-daemon-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-interface< 0:10.0.0-6.el9_4
libvirt-daemon-driver-interface-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-network< 0:10.0.0-6.el9_4
libvirt-daemon-driver-network-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-nodedev< 0:10.0.0-6.el9_4
libvirt-daemon-driver-nodedev-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-nwfilter< 0:10.0.0-6.el9_4
libvirt-daemon-driver-nwfilter-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-qemu< 0:10.0.0-6.el9_4
libvirt-daemon-driver-qemu-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-secret< 0:10.0.0-6.el9_4
libvirt-daemon-driver-secret-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-core< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-core-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-disk< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-disk-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-iscsi< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-iscsi-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-logical< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-logical-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-mpath< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-mpath-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-rbd< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-rbd-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-scsi< 0:10.0.0-6.el9_4
libvirt-daemon-driver-storage-scsi-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-kvm< 0:10.0.0-6.el9_4
libvirt-daemon-lock< 0:10.0.0-6.el9_4
libvirt-daemon-lock-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-log< 0:10.0.0-6.el9_4
libvirt-daemon-log-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-plugin-lockd< 0:10.0.0-6.el9_4
libvirt-daemon-plugin-lockd-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-plugin-sanlock< 0:10.0.0-6.el9_4
libvirt-daemon-plugin-sanlock-debuginfo< 0:10.0.0-6.el9_4
libvirt-daemon-proxy< 0:10.0.0-6.el9_4
libvirt-daemon-proxy-debuginfo< 0:10.0.0-6.el9_4
libvirt-debuginfo< 0:10.0.0-6.el9_4
libvirt-debugsource< 0:10.0.0-6.el9_4
libvirt-devel< 0:10.0.0-6.el9_4
libvirt-docs< 0:10.0.0-6.el9_4
libvirt-libs< 0:10.0.0-6.el9_4
libvirt-libs-debuginfo< 0:10.0.0-6.el9_4
libvirt-nss< 0:10.0.0-6.el9_4
libvirt-nss-debuginfo< 0:10.0.0-6.el9_4
libvirt-wireshark-debuginfo< 0:10.0.0-6.el9_4

Show all 59

Debian2 products

libvirt< 9.0.0-4+deb12u1 | < 9.8.0-1
debian_linuxEOL10.0

Mageia1 product

libvirt< 9.6.0-1.2.mga9

Ubuntu1 product

libvirt< 1.2.2-0ubuntu13.1.28+esm2 | < 1.3.1-1ubuntu10.31+esm1 | < 4.0.0-1ubuntu8.21+esm1 | < 6.0.0-0ubuntu8.19 | < 8.0.0-1ubuntu7.10

4 vendors · 63 products

References

67 links

access.redhat.com/errata/RHSA-2024:2236Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/security/cve/CVE-2024-2496VDB EntryX Refsource REDHATREPORTThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=2269672Issue TrackingX Refsource REDHATREPORTPatch
lists.debian.org/debian-lts-announce/2024/04/msg00000.htmlX TransferredMailing List
advisories.mageia.org/MGASA-2024-0163.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=33162REPORT
lwn.net/Articles/971691/WEB
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/indexARTICLE
issues.redhat.com/browse/RHEL-14611ARTICLE

Show all 67 references

issues.redhat.com/browse/RHEL-15267ARTICLE
issues.redhat.com/browse/RHEL-15288ARTICLE
issues.redhat.com/browse/RHEL-15316ARTICLE
issues.redhat.com/browse/RHEL-15480ARTICLE
issues.redhat.com/browse/RHEL-16870ARTICLE
issues.redhat.com/browse/RHEL-16878ARTICLE
issues.redhat.com/browse/RHEL-1717ARTICLE
issues.redhat.com/browse/RHEL-17596ARTICLE
issues.redhat.com/browse/RHEL-17841ARTICLE
issues.redhat.com/browse/RHEL-18165ARTICLE
issues.redhat.com/browse/RHEL-1833ARTICLE
issues.redhat.com/browse/RHEL-18439ARTICLE
issues.redhat.com/browse/RHEL-18782ARTICLE
issues.redhat.com/browse/RHEL-20337ARTICLE
issues.redhat.com/browse/RHEL-20444ARTICLE
issues.redhat.com/browse/RHEL-20609ARTICLE
issues.redhat.com/browse/RHEL-20807ARTICLE
issues.redhat.com/browse/RHEL-21543ARTICLE
issues.redhat.com/browse/RHEL-22314ARTICLE
issues.redhat.com/browse/RHEL-22714ARTICLE
issues.redhat.com/browse/RHEL-22797ARTICLE
issues.redhat.com/browse/RHEL-22800ARTICLE
issues.redhat.com/browse/RHEL-23170ARTICLE
issues.redhat.com/browse/RHEL-23212ARTICLE
issues.redhat.com/browse/RHEL-24825ARTICLE
issues.redhat.com/browse/RHEL-25858ARTICLE
issues.redhat.com/browse/RHEL-25995ARTICLE
issues.redhat.com/browse/RHEL-3231ARTICLE
issues.redhat.com/browse/RHEL-4432ARTICLE
issues.redhat.com/browse/RHEL-4452ARTICLE
issues.redhat.com/browse/RHEL-4607ARTICLE
issues.redhat.com/browse/RHEL-4994ARTICLE
issues.redhat.com/browse/RHEL-700ARTICLE
issues.redhat.com/browse/RHEL-7040ARTICLE
issues.redhat.com/browse/RHEL-7100ARTICLE
issues.redhat.com/browse/RHEL-7340ARTICLE
issues.redhat.com/browse/RHEL-7345ARTICLE
issues.redhat.com/browse/RHEL-735ARTICLE
issues.redhat.com/browse/RHEL-7382ARTICLE
issues.redhat.com/browse/RHEL-7386ARTICLE
issues.redhat.com/browse/RHEL-7416ARTICLE
issues.redhat.com/browse/RHEL-7419ARTICLE
issues.redhat.com/browse/RHEL-7525ARTICLE
issues.redhat.com/browse/RHEL-7528ARTICLE
issues.redhat.com/browse/RHEL-7542ARTICLE
issues.redhat.com/browse/RHEL-7545ARTICLE
issues.redhat.com/browse/RHEL-7568ARTICLE
issues.redhat.com/browse/RHEL-7569ARTICLE
issues.redhat.com/browse/RHEL-7570ARTICLE
issues.redhat.com/browse/RHEL-974ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2236.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2024-2496AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-2496AdvisoryOval
ubuntu.com/security/CVE-2024-2496REPORT
ubuntu.com/security/notices/USN-6734-1Advisory
ubuntu.com/security/notices/USN-8652-1Advisory
security-tracker.debian.org/tracker/CVE-2024-2496Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities