CVE-2024-1441

What it actually does

Off-by-one error in udevListInterfacesByStatus() allows an unprivileged local client to supply crafted data that overflows the bounds of the names array, crashing the libvirt daemon.

Why it matters to the business

Sudden loss of virtualization management and guest control on any host running the affected libvirt daemon; repeated crashes can disrupt automated provisioning, live migration, and monitoring workflows until the service is restarted.

How an attack unfolds

An attacker with a local account on a system hosting libvirt sends a specially crafted request to the daemon that causes the number of reported interfaces to exceed the size of the names array; the resulting off-by-one write triggers a crash, achieving denial of service without requiring elevated privileges.

How to fix it

Upgrade libvirt to a version containing the corrected udevListInterfacesByStatus() implementation; until patches are available, restrict local access to the libvirt socket and consider rate-limiting or sandboxing untrusted clients that can connect to the daemon.

How to confirm the fix worked

Confirm the installed libvirt package version is newer than the vulnerable release; attempt to reproduce the crash with a test client that supplies an oversized interface list and verify the daemon remains stable.

Typical attack path

1. Obtain a local shell on a host running the libvirt daemon
2. Craft a request that triggers udevListInterfacesByStatus() with more interfaces than the names array can hold
3. Send the request over the local libvirt socket or API
4. Observe daemon crash and restart loop

How to detect it

Monitor system and libvirt logs for repeated daemon crashes or segmentation faults immediately after API calls involving interface enumeration; look for entries containing udevListInterfacesByStatus or abnormal termination of libvirtd.

• libvirtd: segfault at
• udevListInterfacesByStatus
• libvirt daemon crashed

What your security team should do

• Apply the vendor-supplied libvirt update as soon as it becomes available
• Restrict local accounts that can connect to the libvirt socket to the minimum necessary set
• Enable process monitoring and automatic restart for the libvirtd service
• Add crash-log alerts for libvirtd to the SOC queue