CVE-2024-41184

A flaw was found in the keepalived package. An integer overflow occurs when incorrect arguments are passed. As a result, reading from an undefined address takes place.

The described vulnerability in the keepalived package, characterized by an integer overflow in the vrrp_ipsets_handler function of fglobal_parser.c, is assessed as moderate severity rather than important due to the specific conditions required for exploitation. The flaw necessitates the manual configuration of an empty ipset name, a scenario that deviates from standard operational procedures. This constraint significantly reduces the likelihood of the vulnerability being exploited in typical deployment environments. Additionally, the primary consequence of this integer overflow is reading from an undefined address, which, while potentially disruptive, is less severe compared to vulnerabilities that allow arbitrary code execution or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.