一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A NULL pointer dereference issue was found in libvirt in the udevConnectListAllInterfaces() function. It could occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API.Upstream fix:https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8

漏洞公开时间：

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A NULL pointer dereference issue was found in libvirt in the udevConnectListAllInterfaces() function. It could occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API.Upstream fix:https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8

漏洞公开时间：

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A NULL pointer dereference issue was found in libvirt in the udevConnectListAllInterfaces() function. It could occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API.Upstream fix:https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8

漏洞公开时间：

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-2496 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| snyk | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBVIRT-6445979 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | suse_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| secalert.redhat.com | https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-2496 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| snyk | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBVIRT-6445979 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | suse_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.0

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| secalert.redhat.com | https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-2496 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| snyk | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBVIRT-6445979 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | suse_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.0

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| secalert.redhat.com | https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| secalert.redhat.com | https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://access.redhat.com/security/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-2496 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| snyk | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBVIRT-6445979 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | suse_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.0

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(6.2.0):

2.openEuler-20.03-LTS-SP1(6.2.0):

3.openEuler-20.03-LTS-SP4(6.2.0):

4.openEuler-22.03-LTS(6.2.0):

5.openEuler-22.03-LTS-Next(6.2.0):

6.openEuler-22.03-LTS-SP1(6.2.0):

7.openEuler-22.03-LTS-SP2(6.2.0):

8.openEuler-22.03-LTS-SP3(6.2.0):

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| ubuntu | https://access.redhat.com/security/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/errata/RHSA-2024:2236 | |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| secalert.redhat.com | https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| ubuntu | https://access.redhat.com/security/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://ubuntu.com/security/notices/USN-6734-1 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://ubuntu.com/security/CVE-2024-2496 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2024-2496 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-2496 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| mageia | | http://advisories.mageia.org/MGASA-2024-0163.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| snyk | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBVIRT-6445979 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | suse_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | snyk |

| libvirt | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | ubuntu |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | debian |

</details>

二、漏洞分析结构反馈

影响性分析说明：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

openEuler评分：

5.0

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP4(6.2.0):受影响

2.openEuler-22.03-LTS-SP1(6.2.0):受影响

3.openEuler-22.03-LTS-SP3(6.2.0):受影响

4.master(9.10.0):不受影响

5.openEuler-22.03-LTS-SP4(6.2.0):不受影响

6.openEuler-24.03-LTS(9.10.0):不受影响

7.openEuler-24.03-LTS-Next(9.10.0):不受影响

修复是否涉及abi变化(是/否)：

1.master(9.10.0):否

2.openEuler-20.03-LTS-SP4(6.2.0):否

3.openEuler-22.03-LTS-SP1(6.2.0):否

4.openEuler-22.03-LTS-SP3(6.2.0):否

5.openEuler-22.03-LTS-SP4(6.2.0):否

6.openEuler-24.03-LTS(9.10.0):否

7.openEuler-24.03-LTS-Next(9.10.0):否

一、漏洞信息

漏洞编号：[CVE-2024-2496](https://nvd.nist.gov/vuln/detail/CVE-2024-2496)

漏洞归属组件：[libvirt](https://gitee.com/src-openeuler/libvirt)

漏洞归属的版本：6.2.0

CVSS V3.0分值：

BaseScore：5.0 Medium

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

漏洞简述：

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

漏洞公开时间：2024-03-18 21:15:08

漏洞创建时间：2024-03-15 18:27:18

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-2496

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| secalert.redhat.com | https://access.redhat.com/errata/RHSA-2024:2236 | |

| secalert.redhat.com | https://access.redhat.com/security/cve/CVE-2024-2496 | |

| secalert.redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | |

| secalert.redhat.com | https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html | |

| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2496 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| suse_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.suse.com/show_bug.cgi?id=1221468 |

| redhat_bugzilla | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| ubuntu | https://access.redhat.com/security/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://www.cve.org/CVERecord?id=CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://ubuntu.com/security/notices/USN-6734-1 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://launchpad.net/bugs/cve/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://security-tracker.debian.org/tracker/CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

| ubuntu | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 | https://ubuntu.com/security/CVE-2024-2496 |

| debian | | https://security-tracker.debian.org/tracker/CVE-2024-2496 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-2496 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269672 |

| mageia | | http://advisories.mageia.org/MGASA-2024-0163.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://explore.alas.aws.amazon.com/CVE-2024-2496.html |

| snyk | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBVIRT-6445979 |

| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2496 | https://ubuntu.com/security/CVE-2024-2496 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | suse_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | redhat_bugzilla |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | snyk |

| libvirt | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | ubuntu |

| | | https://gitlab.com/libvirt/libvirt/-/commit/2ca94317ac642a70921947150ced8acc674ccdc8 | | debian |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.0

Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP4(6.2.0):受影响

2.openEuler-22.03-LTS-SP1(6.2.0):受影响

3.openEuler-22.03-LTS-SP3(6.2.0):受影响

4.master(9.10.0):不受影响

5.openEuler-22.03-LTS-SP4(6.2.0):不受影响

6.openEuler-24.03-LTS(9.10.0):不受影响

7.openEuler-24.03-LTS-Next(9.10.0):不受影响

修复是否涉及abi变化(是/否)：

1.master(9.10.0):否

2.openEuler-20.03-LTS-SP4(6.2.0):否

3.openEuler-22.03-LTS-SP1(6.2.0):否

4.openEuler-22.03-LTS-SP3(6.2.0):否

5.openEuler-22.03-LTS-SP4(6.2.0):否

6.openEuler-24.03-LTS(9.10.0):否

7.openEuler-24.03-LTS-Next(9.10.0):否