Описание
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
A flaw was found in Libevent, an event notification library. This vulnerability allows a local attacker to trigger a null pointer dereference during specific error handling within the evws_new_session function. By inducing an allocation or locking failure, an attacker can cause the application to crash, leading to a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libevent | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libevent | Out of support scope | ||
| Red Hat Enterprise Linux 6 | libevent2 | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libevent | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libevent | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libevent | Affected | ||
| Red Hat Hardened Images | libevent | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
Libevent is an event notification library. Prior to 2.2.2-alpha, libev ...
Уязвимость функции evws_new_session() библиотеки асинхронного уведомления событий Libevent, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
4.7 Medium
CVSS3