CVE catalog
CVE-2024-2494
libvirt vulnerabilities
- Severity
- Medium · CVSS 6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libvirt | sid | 12.8.0-1 | fixed |
| Debian | libvirt | forky | 12.8.0-1 | fixed |
| Debian | libvirt | trixie | 11.3.0-3+deb13u3 | fixed |
| Debian | libvirt | bookworm | 9.0.0-4+deb12u2 | fixed |
| Ubuntu | libvirt | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libnss-libvirt | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-clients | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-clients-qemu | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-config-network | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-config-nwfilter | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-lxc | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-qemu | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-storage-gluster | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-storage-iscsi-direct | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-storage-rbd | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-storage-zfs | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-vbox | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-driver-xen | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-system | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-system-systemd | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-daemon-system-sysv | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-dev | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-doc | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-l10n | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-login-shell | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-sanlock | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt-wireshark | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt0 | noble | 10.0.0-2ubuntu8.1 | fixed |
| Ubuntu | libvirt | pro | 3.6.0-1ubuntu5 | vulnerable |
| Ubuntu | libvirt | pro | 3.6.0-1ubuntu6 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu1 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu2 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu3 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu4 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu5 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu6 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu7 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.1 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.2 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.3 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.4 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.5 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.6 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.7 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.8 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.9 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.10 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.11 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.12 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.13 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.14 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.15 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.16 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.17 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.19 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.20 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.21 | vulnerable |
| Ubuntu | libvirt | pro | 4.0.0-1ubuntu8.21+esm1 | fixed |
| Ubuntu | libvirt | 20.04 | 5.4.0-0ubuntu5 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu1 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu2 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu3 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu4 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu5 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu6 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu7 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.1 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.2 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.3 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.4 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.5 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.7 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.8 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.9 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.10 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.11 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.12 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.13 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.14 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.15 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.16 | vulnerable |
| Ubuntu | libvirt | 20.04 | 6.0.0-0ubuntu8.19 | fixed |
| Ubuntu | libvirt | 22.04 | 7.6.0-0ubuntu1 | vulnerable |
| Ubuntu | libvirt | 22.04 | 7.6.0-0ubuntu3 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu3 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu4 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu5 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu6 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.1 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.2 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.3 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.4 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.5 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.6 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.7 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.8 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.9 | vulnerable |
| Ubuntu | libvirt | 22.04 | 8.0.0-1ubuntu7.10 | fixed |
| Ubuntu | libvirt | 24.04 | 9.6.0-1ubuntu1 | vulnerable |
| Ubuntu | libvirt | 24.04 | 9.6.0-1ubuntu2 | vulnerable |
| Ubuntu | libvirt | 24.04 | 10.0.0-1ubuntu1 | vulnerable |
| Ubuntu | libvirt | 24.04 | 10.0.0-2ubuntu1 | vulnerable |
| Ubuntu | libvirt | 24.04 | 10.0.0-2ubuntu5 | vulnerable |
| Ubuntu | libvirt | 24.04 | 10.0.0-2ubuntu7 | vulnerable |
| Ubuntu | libvirt | 24.04 | 10.0.0-2ubuntu8 | vulnerable |
| Ubuntu | libvirt | 24.04 | 10.0.0-2ubuntu8.1 | fixed |
| Suse | libvirt | linux enterprise micro 5.3 | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | linux enterprise micro 5.4 | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | linux enterprise high performance computing 15 sp4-espos | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | linux enterprise high performance computing 15 sp4-ltss | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | linux enterprise server 15 sp4-ltss | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | linux enterprise server for sap applications 15 sp4 | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | manager proxy 4.3 | 8.0.0-150400.7.11.2 | fixed |
| Suse | libvirt | manager server 4.3 | 8.0.0-150400.7.11.2 | fixed |
| Opensuse | libvirt | leap micro 5.3 | 8.0.0-150400.7.11.2 | fixed |
| Opensuse | libvirt | leap micro 5.4 | 8.0.0-150400.7.11.2 | fixed |
| Opensuse | libvirt | tumbleweed | 10.1.0-2.1 | fixed |
| Suse | libvirt | linux enterprise module for server applications 15 sp5 | 7.1.0-150300.6.41.1 | fixed |
| Suse | libvirt | linux enterprise micro 5.1 | 7.1.0-150300.6.41.1 | fixed |
| Suse | libvirt | linux enterprise micro 5.2 | 7.1.0-150300.6.41.1 | fixed |
| Suse | libvirt | linux enterprise software development kit 12 sp5 | 5.1.0-13.42.1 | fixed |
| Suse | libvirt | linux enterprise server 12 sp5 | 5.1.0-13.42.1 | fixed |
| Suse | libvirt | linux enterprise server for sap applications 12 sp5 | 5.1.0-13.42.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libvirt | source | sid | 10.2.0-1 | not yet assigned | Not reported | [1067461] |
| Debian | libvirt | source | forky | 10.2.0-1 | not yet assigned | Not reported | [1067461] |
| Debian | libvirt | source | trixie | 10.2.0-1 | not yet assigned | Not reported | [1067461] |
| Debian | libvirt | source | bookworm | 9.0.0-4+deb12u1 | not yet assigned | Not reported | [1067461] |
| Ubuntu | libvirt | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libnss-libvirt | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-clients | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-clients-qemu | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-config-network | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-config-nwfilter | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-lxc | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-qemu | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-storage-gluster | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-storage-iscsi-direct | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-storage-rbd | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-storage-zfs | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-vbox | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-driver-xen | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-system | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-system-systemd | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-daemon-system-sysv | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-dev | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-doc | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-l10n | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-login-shell | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-sanlock | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt-wireshark | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt0 | deb | noble | 10.0.0-2ubuntu8.1 | Not reported | Not reported | Not reported |
| Ubuntu | libvirt | deb | pro | 4.0.0-1ubuntu8.21+esm1 | Not reported | UBUNTU-CVE-2024-2494 | Not reported |
| Ubuntu | libvirt | deb | 20.04 | 6.0.0-0ubuntu8.19 | Not reported | UBUNTU-CVE-2024-2494 | Not reported |
| Ubuntu | libvirt | deb | 22.04 | 8.0.0-1ubuntu7.10 | Not reported | UBUNTU-CVE-2024-2494 | Not reported |
| Ubuntu | libvirt | deb | 24.04 | 10.0.0-2ubuntu8.1 | Not reported | UBUNTU-CVE-2024-2494 | Not reported |
| Suse | libvirt | rpm | linux enterprise micro 5.3 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise micro 5.4 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise high performance computing 15 sp4-espos | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise high performance computing 15 sp4-ltss | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise server 15 sp4-ltss | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise server for sap applications 15 sp4 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | manager proxy 4.3 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Suse | libvirt | rpm | manager server 4.3 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Opensuse | libvirt | rpm | leap micro 5.3 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Opensuse | libvirt | rpm | leap micro 5.4 | 8.0.0-150400.7.11.2 | Not reported | SUSE-SU-2024:1100-1 | Not reported |
| Opensuse | libvirt | rpm | tumbleweed | 10.1.0-2.1 | Not reported | OPENSUSE-SU-2024:13796-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise module for server applications 15 sp5 | 7.1.0-150300.6.41.1 | Not reported | SUSE-SU-2024:1078-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise micro 5.1 | 7.1.0-150300.6.41.1 | Not reported | SUSE-SU-2024:1078-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise micro 5.2 | 7.1.0-150300.6.41.1 | Not reported | SUSE-SU-2024:1078-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise software development kit 12 sp5 | 5.1.0-13.42.1 | Not reported | SUSE-SU-2024:1083-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise server 12 sp5 | 5.1.0-13.42.1 | Not reported | SUSE-SU-2024:1083-1 | Not reported |
| Suse | libvirt | rpm | linux enterprise server for sap applications 12 sp5 | 5.1.0-13.42.1 | Not reported | SUSE-SU-2024:1083-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1078-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-2494]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1078-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1083-1]
- [https://osv.dev/vulnerability/SUSE-SU-2024:1100-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-2494]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13796-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-2494]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-2494.json]
- [https://ubuntu.com/security/notices/USN-6734-2]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0692.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]