Description

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-20T10:16:40.507Z",
  "pubdate": "2026-08-20T10:16:40.507Z",
  "executiveSummary": "A vulnerability exists in libvirt affecting the NodeGetFreePages RPC handler, characterized as an integer overflow leading to a heap-based buffer overflow. The flaw can be exploited by an unprivileged local user to compromise the integrity of the root libvirt daemon, potentially resulting in a denial of service condition or local privilege escalation.\nThe vulnerability stems from improper validation of input parameters within the NodeGetFreePages RPC handler. Specifically, crafted values supplied by an attacker can bypass intended size checks, causing the allocation of an undersized memory buffer. Subsequent operations write real NUMA node data into this constrained memory region, inducing a heap buffer overflow.\nSuccessful exploitation requires local access to the system and the ability to interact with the libvirt daemon via its RPC mechanism. While the attacker requires no initial high-privilege access, the resulting memory corruption occurs within the context of the root-privileged libvirt daemon, elevating the risk profile significantly.\nOrganizations utilizing vulnerable versions of libvirt are exposed to potential system instability, service outages, and full host compromise via privilege escalation. Remediation requires applying official patches provided by the maintainers and restricting unauthorized access to the libvirt management socket.",
  "technicalDetails": "The vulnerability resides in the libvirt daemon, specifically within the NodeGetFreePages remote procedure call (RPC) handler component. The root cause is an integer overflow condition that occurs when processing size parameters provided by the client.\nDuring the execution of the NodeGetFreePages handler, libvirt calculates memory buffer requirements based on input supplied via the RPC interface. Due to the lack of adequate bounds checking and safe integer arithmetic, an unprivileged local attacker can supply carefully crafted values that trigger an integer overflow. This overflow circumvents the preliminary size validation checks implemented in the function.\nAs a result of the bypassed validation, the application allocates a memory buffer that is significantly smaller than required to store the requested data. Following this allocation, the daemon proceeds to populate the buffer with authentic Non-Uniform Memory Access (NUMA) node data retrieved from the system. Because the actual data size exceeds the allocated buffer capacity, a classic heap-based buffer overflow occurs.\nThe payload behavior involves the sequential writing of NUMA node data past the boundaries of the undersized heap allocation. This out-of-bounds write overwrites adjacent heap metadata and critical daemon memory structures belonging to the root libvirt process.\nThe post-exploitation impact depends on the specific memory corruption pattern achieved. An attacker can corrupt heap management structures or function pointers, leading to an immediate crash of the libvirt daemon and resulting in a denial of service (DoS). Furthermore, careful manipulation of the corrupted heap state can theoretically allow for arbitrary code execution with root privileges, achieving local privilege escalation.\nAuthentication requirements are minimal, as the attack leverages standard local access paths to the libvirt RPC interface, which unprivileged local users are typically permitted to access depending on the configured access control lists and policy kit rules. The attack vector is strictly local, requiring no network exposure beyond the local Unix domain socket used for libvirt inter-process communication."
}