REDHAT-BUG-2302487: Medium severity qemu vulnerability
A flaw was discovered in the qemu code for temporarily exposing an NBD server (used for storage migration and other tasks), where qemu can crash if a client still has a socket open at the time the server is taken offline. Even when qemu is set up to only accept clients with proper TLS credentials, an attacker without the TLS credentials can exploit the flaw by connecting a second socket while a storage migration is ongoing through the intended socket, where the attacker then stalls the NBD handshake to not reach the point of the TLS negotiation, then waiting for the server to go offline. When the NBD server is stopped, closing the attacker's socket can cause qemu to crash, forming a denial of service attack.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
QEMU deployments that temporarily expose an NBD server for storage migration or similar tasks are exposed. The issue requires an attacker to be able to connect to that NBD server while it is active.
Does configuring TLS client authentication prevent exploitation?
No. An attacker without valid TLS credentials can connect a second socket and stall the NBD handshake before TLS negotiation occurs, then trigger the crash when the NBD server is taken offline.
What conditions are required for an attacker to crash QEMU?
A legitimate storage migration or other operation must be using the temporarily exposed NBD server, and the attacker must establish a separate connection during that period. The attacker stalls that connection's handshake and waits for the server to stop, at which point closing the socket can crash QEMU.