The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1005-1 advisory.

  - An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number     of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially     crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack     by causing the libvirt daemon to crash. (CVE-2024-1441)

  - A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This     issue can occur when detaching a host interface while at the same time collecting the list of interfaces     via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by     causing the libvirt daemon to crash. (CVE-2024-2496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12 Security Update : libvirt (SUSE-SU-2024:1005-1)

medium Nessus Plugin ID 192668

Version 1.1

Version 1.0

Version 1.1 Mar 29, 2024, 1:58 PM IAVM reference STIG Severity (set) Plugin Feed: 202403291358
Version 1.0 Mar 28, 2024, 4:35 PM New Plugin Feed: 202403281635