CVE-2024-3446: Qemu: virtio: dma reentrancy issue leads to double free vulnerability
A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the memreentrancyguard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.
Other sources
It was found that the memreentrancyguard flag did not sufficiently protect against DMA reentrancy issues in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), leading to a double free vulnerability. A malicious privileged guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host.
Upstream patch: https://patchew.org/QEMU/20240409105537.18308-1-philmd@linaro.org/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
QEMUto a version that resolves this vulnerability.Patch QEMU/20240409105537.18308-1-philmd@linaro.org
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3446?
CVE-2024-3446 has been classified as a high-severity vulnerability due to its potential to allow a malicious user to crash the QEMU process.
How do I fix CVE-2024-3446?
To mitigate CVE-2024-3446, it is recommended to update QEMU to the latest version that includes security patches addressing this vulnerability.
Which QEMU versions are affected by CVE-2024-3446?
CVE-2024-3446 affects various versions of QEMU that utilize virtio devices, specifically virtio-gpu, virtio-serial-bus, and virtio-crypto.
What type of vulnerability is CVE-2024-3446?
CVE-2024-3446 is a double free vulnerability that arises from insufficient protection against DMA reentrancy issues within QEMU.
Can CVE-2024-3446 be exploited remotely?
CVE-2024-3446 requires a privileged guest user context for exploitation, meaning it cannot be directly exploited remotely without access to the guest environment.