CVE-2024-36474

What it actually does

Integer overflow in libgsf Compound Document parser causes out-of-bounds array indexing during directory processing, enabling arbitrary read/write and code execution.

Why it matters to the business

Compromise of virtualization management workloads could allow attackers to run code on hosts handling VM-related files, disrupting operations and risking data exposure.

How an attack unfolds

An attacker supplies a specially crafted compound document file to a kubevirt component that uses libgsf; the overflow occurs during directory parsing, corrupting memory to achieve code execution.

How to fix it

Upgrade kubevirt.io/kubevirt to version 0.55.1 or later.

How to confirm the fix worked

Confirm deployed kubevirt version is 0.55.1 or newer; reprocess sample files with updated library to verify absence of crash or corruption.

Typical attack path

1. Craft malicious compound document file triggering integer overflow in directory handling
2. Deliver file to kubevirt instance for processing
3. Trigger file parsing path in affected component
4. Exploit resulting out-of-bounds access for code execution

How to detect it

Review kubevirt and libgsf logs for parsing errors or crashes on compound document files; correlate with unexpected process behavior or memory anomalies.

What your security team should do

• Upgrade all kubevirt deployments to 0.55.1 without delay
• Inventory and isolate any remaining older instances
• Add file-type validation and sandboxing for processed documents