REDHAT-BUG-2443789: Integer Overflow
An integer overflow vulnerability was found in the virtio-snd device via PCMINFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
Upstream patch series: https://lore.kernel.org/qemu-devel/20260220-virtio-snd-series-v1-0-207c4f7200a2@linaro.org/
QEMU fix commit: https://gitlab.com/qemu-project/qemu/-/commit/61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
qemu/qemuto a version that resolves this vulnerability.Patch 61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c - Configuration
Do not attach virtual audio (virtio-snd) devices to guests or disable the virtio-snd device until the QEMU fix (commit 61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c) has been applied.
virtio-snd device (QEMU) enable/attach = false - Compensating control
Restrict use of virtio-snd to trusted guests only and apply isolation for untrusted VMs (remove virtual audio devices from untrusted VMs, limit VM/device assignment to trusted administrators, and enforce host/management interface access controls) to mitigate potential DoS from a malicious guest.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2443789?
The severity of REDHAT-BUG-2443789 is medium, rated at 4.
What type of vulnerability is REDHAT-BUG-2443789?
REDHAT-BUG-2443789 is an integer overflow vulnerability.
How do I fix REDHAT-BUG-2443789?
To fix REDHAT-BUG-2443789, apply the upstream patch provided in the patch series.
What attack vector is associated with REDHAT-BUG-2443789?
A malicious guest can exploit REDHAT-BUG-2443789 by providing out-of-bounds stream counts through PCM_INFO requests.
What are the potential consequences of exploiting REDHAT-BUG-2443789?
Exploiting REDHAT-BUG-2443789 can lead to unbounded memory allocation on the host and result in a denial of service condition.