CVE-2024-41184

What it actually does

Integer overflow in the vrrp_ipsets_handler function within the configuration parser allows memory corruption when an empty ipset name is supplied during VRRP processing.

Why it matters to the business

Potential remote code execution or denial of service on systems running high-availability networking services, though real-world exposure is constrained by the requirement for an empty ipset name in user configuration; low EPSS and absence from KEV indicate limited active threat.

How an attack unfolds

An attacker supplies a keepalived configuration containing an empty ipset name that reaches the vulnerable handler during parsing, triggering the integer overflow to corrupt memory and potentially achieve code execution.

How to fix it

Upgrade keepalived to a version newer than 2.3.1 and audit all configuration files to ensure no empty ipset names are present.

How to confirm the fix worked

Verify installed keepalived version exceeds 2.3.1 and scan configuration files for any ipset directives lacking a name value.

Typical attack path

1. Obtain or influence the keepalived configuration file
2. Insert an empty ipset name directive
3. Cause keepalived to parse the configuration
4. Trigger the overflow in vrrp_ipsets_handler for memory corruption

How to detect it

Review keepalived configuration files and startup logs for parsing entries involving ipset names; monitor for unexpected process crashes or memory errors during VRRP initialization.

What your security team should do

• Audit and correct keepalived configuration files to eliminate empty ipset names
• Plan upgrade of keepalived beyond version 2.3.1 across all deployments
• Add configuration validation steps to deployment pipelines