CVE-2024-2494

What it actually does

The RPC server deserialization code in the affected library allocates memory for arrays using g_new0 before validating that the length is non-negative, allowing a negative value to be interpreted as a very large positive number and triggering a crash.

Why it matters to the business

Local users can interrupt virtualization or related management services, leading to temporary loss of availability for virtual machine operations with low likelihood given the low exploit probability and absence from known exploitation lists.

How an attack unfolds

A local unprivileged attacker invokes an RPC API entry point with a negative array length value; the deserialization path allocates memory before the C API length check, causing the daemon to crash and resulting in denial of service.

How to fix it

Upgrade all affected packages to the fixed versions: java-1.8.0-openjdk-accessibility-fastdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-accessibility-slowdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-demo-fastdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-devel-fastdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-devel-slowdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-fastdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-headless-fastdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-src-fastdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, java-1.8.0-openjdk-src-slowdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later, and java-1.8.0-openjdk-slowdebug (AlmaLinux:8) to 1:1.8.0.302.b08-0.el8_4 or later.

How to confirm the fix worked

Confirm the installed package versions match or exceed the listed fixed releases and verify that RPC calls with negative lengths no longer cause daemon crashes in testing.

Typical attack path

1. Obtain local unprivileged access on a system running the affected library
2. Craft an RPC request containing a negative length value for an array parameter
3. Invoke the vulnerable deserialization code path through the library API
4. Trigger memory allocation with the misinterpreted length causing process crash

How to detect it

Review system and daemon logs for unexpected crashes or restarts around the time of suspected local activity; no widespread network indicators exist due to the local-only attack vector and lack of observed exploitation.

What your security team should do

• Apply the listed package updates immediately on all affected AlmaLinux 8 systems
• Restrict local access to systems hosting the library where possible until patches are deployed
• Monitor for any unexpected daemon restarts in system logs as a general stability check