udevIfaceListAllInterface() used the udev_device after it had its ref count decremented which results in a use after free issue. --- src/interface/interface_backend_udev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index 92c35d9..2c41bde 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -359,7 +359,6 @@ udevIfaceListAllInterfaces(virConnectPtr conn, name = udev_device_get_sysname(dev); macaddr = udev_device_get_sysattr_value(dev, "address"); status = STREQ(udev_device_get_sysattr_value(dev, "operstate"), "up"); - udev_device_unref(dev); /* Filter the results */ if (status && (flags & VIR_CONNECT_LIST_INTERFACES_ACTIVE)) @@ -375,6 +374,7 @@ udevIfaceListAllInterfaces(virConnectPtr conn, } count++; } + udev_device_unref(dev); } /* Drop our refcounts */ -- 1.7.12.4