REDHAT-BUG-2279965
First published: Fri May 10 2024(Updated: )
A flaw was found in QEMU in the Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). The original patch [1] was found to be incomplete and is currently being reworked upstream [2][3]. [1] <a href="https://gitlab.com/qemu-project/qemu/-/commit/fcbb086ae590e910614fe5b8bf76e264f71ef304">https://gitlab.com/qemu-project/qemu/-/commit/fcbb086ae590e910614fe5b8bf76e264f71ef304</a> [2] <a href="https://gitlab.com/qemu-project/qemu/-/issues/2321">https://gitlab.com/qemu-project/qemu/-/issues/2321</a> [3] <a href="https://gitlab.com/qemu-project/qemu/-/issues/2334">https://gitlab.com/qemu-project/qemu/-/issues/2334</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gitlab.com/qemu-project/qemu/-/commit/fcbb086ae590e910614fe5b8bf76e264f71ef304
- https://gitlab.com/qemu-project/qemu/-/issues/2321
- https://gitlab.com/qemu-project/qemu/-/issues/2334
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2279966
- https://gitlab.com/qemu-project/qemu/-/commit/7eeb62b0ce3a8f64647bf53f93903abd1fbb0b94
- https://bugzilla.redhat.com/show_bug.cgi?id=2279965
Frequently Asked Questions
What is the severity of REDHAT-BUG-2279965?
REDHAT-BUG-2279965 is considered a critical vulnerability due to its potential to cause guest crashes.
How do I fix REDHAT-BUG-2279965?
To address REDHAT-BUG-2279965, apply the latest patch provided by the QEMU project when it becomes available.
What systems are affected by REDHAT-BUG-2279965?
REDHAT-BUG-2279965 specifically affects systems running QEMU with Virtio PCI Bindings.
Can REDHAT-BUG-2279965 be exploited remotely?
Yes, REDHAT-BUG-2279965 can be exploited by a guest to trigger a crash in the host environment.
What is the cause of the vulnerability in REDHAT-BUG-2279965?
The vulnerability in REDHAT-BUG-2279965 is caused by improper handling of the irqfd for vector 0 during the QEMU boot process.
- agent/severity
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-4693
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/qemu
- canonical/qemu