CVE-2024-7730: Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()
A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtiosndpcmincb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtiosndpcmstatus, which makes the available space for audio data zero.
Other sources
Qemu-kvm: virtio-snd: heap buffer overflow in virtiosndpcmincb()
— Microsoft
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
When reading input audio in the virtio-snd input callback, virtiosndpcmincb(), we do not check whether the iov can actually fit the data buffer. This is because we use the buffer->size field as a total-so-far accumulator instead of byte-size-left like in TX buffers.
This triggers an out of bounds write if the size of the virtio queue element is equal to virtiosndpcmstatus, which makes the available space for audio data zero. This commit adds a check for reaching the maximum buffer size before attempting any writes.
Reference: https://lore.kernel.org/qemu-devel/virtio-snd-fuzz-2427-fix-v1-manos.pitsidianakis@linaro.org/
Upstream issue: https://gitlab.com/qemu-project/qemu/-/issues/2427
Upstream fix: https://gitlab.com/qemu-project/qemu/-/commit/98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7730?
CVE-2024-7730 has a high severity rating due to the potential for a heap buffer overflow that can lead to out-of-bounds write vulnerabilities.
How do I fix CVE-2024-7730?
To fix CVE-2024-7730, update to the patched version of QEMU, specifically version 1:9.2.0+ds-5 or later.
Which versions of QEMU are affected by CVE-2024-7730?
CVE-2024-7730 affects QEMU versions up to and including 1:5.2+dfsg-11+deb11u3, 1:5.2+dfsg-11+deb11u2, and 1:7.2+dfsg-7+deb12u12.
What components are impacted by CVE-2024-7730?
CVE-2024-7730 impacts the virtio-snd device within QEMU, particularly during the audio input read operations.
Is CVE-2024-7730 an exploitative vulnerability?
Yes, CVE-2024-7730 can potentially be exploited to execute arbitrary code due to the heap buffer overflow.