Out-of-bounds read in QEMU - CVE-2024-6505

Vulnerability identifier: #VU94527

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-6505

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the virtio-net device in QEMU when enabling the RSS feature on the virtio-net network card. A remote privileged user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

QEMU
SUSE Linux Enterprise Server 15 SP4
SUSE Manager Server 4.3
SUSE Manager Retail Branch Server 4.3
SUSE Linux Enterprise Server 15 SP5
SUSE Manager Proxy 4.3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu-arm
qemu-hw-s390x-virtio-gpu-ccw
qemu-chardev-spice-debuginfo
qemu-hw-display-qxl-debuginfo
qemu-audio-pa-debuginfo
qemu-chardev-baum-debuginfo
qemu-block-iscsi
qemu-guest-agent
qemu-ivshmem-tools-debuginfo
qemu-block-gluster
qemu-s390x-debuginfo
qemu-ui-curses-debuginfo
qemu-ui-spice-core
qemu-audio-alsa
qemu-vhost-user-gpu-debuginfo
qemu-lang
qemu-block-nfs
qemu-block-ssh-debuginfo
qemu-ksm
qemu-hw-usb-redirect-debuginfo
qemu-s390x
qemu-hw-display-virtio-gpu-pci
qemu-tools
qemu-block-dmg
qemu-extra
qemu-ui-gtk-debuginfo
qemu-ui-opengl-debuginfo
qemu-block-dmg-debuginfo
qemu
qemu-hw-usb-smartcard-debuginfo
qemu-ui-opengl
qemu-ui-spice-app
qemu-audio-spice-debuginfo
qemu-ui-gtk
qemu-linux-user-debuginfo
qemu-guest-agent-debuginfo
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-hw-usb-smartcard
qemu-ppc
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-hw-display-virtio-vga
qemu-tools-debuginfo
qemu-block-gluster-debuginfo
qemu-block-iscsi-debuginfo
qemu-audio-spice
qemu-hw-usb-redirect
qemu-block-curl
qemu-vhost-user-gpu
qemu-hw-display-virtio-vga-debuginfo
qemu-linux-user
qemu-chardev-baum
qemu-ui-curses
qemu-kvm
qemu-microvm
qemu-SLOF
qemu-skiboot
qemu-block-rbd-debuginfo
qemu-block-rbd
qemu-debuginfo
qemu-arm-debuginfo
qemu-block-curl-debuginfo
qemu-x86
qemu-ui-spice-app-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-chardev-spice
qemu-audio-pa
qemu-hw-display-qxl
qemu-linux-user-debugsource
qemu-audio-alsa-debuginfo
qemu-debugsource
qemu-block-ssh
qemu-extra-debuginfo
qemu-x86-debuginfo
qemu-block-nfs-debuginfo
qemu-ppc-debuginfo
qemu-hw-display-virtio-gpu
qemu-ivshmem-tools
qemu-ui-spice-core-debuginfo
qemu-testsuite
qemu (Ubuntu package)
qemu-img
qemu-system-aarch64
qemu-system-arm
qemu-system-riscv
qemu-system-x86_64
qemu-help
qemu-hw-usb-host
qemu-accel-tcg-x86-debuginfo
qemu-accel-tcg-x86
qemu-audio-jack-debuginfo
qemu-audio-oss
qemu-accel-qtest
qemu-audio-jack
qemu-accel-qtest-debuginfo
qemu-audio-oss-debuginfo
qemu-hw-usb-host-debuginfo
qemu-audio-dbus-debuginfo
qemu-ui-dbus
qemu-audio-dbus
qemu-headless
qemu-ui-dbus-debuginfo
qemu-sgabios

Install updates from vendor's website.

qemu-ipxe - addressed in versions 1.0.0+-150300.138.1, 1.0.0+-150400.37.46.1, 1.0.0+-150500.49.36.2
qemu-vgabios - addressed in versions 1.14.0_0_g155821a-150300.138.1, 1.15.0_0_g2dd4b9b-150400.37.46.1, 1.16.0_0_gd239552-150500.49.36.2
qemu-seabios - addressed in versions 1.14.0_0_g155821a-150300.138.1, 1.15.0_0_g2dd4b9b-150400.37.46.1, 1.16.0_0_gd239552-150500.49.36.2
qemu-arm - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-s390x-virtio-gpu-ccw - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-chardev-spice-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-qxl-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-pa-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-chardev-baum-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-iscsi - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-guest-agent - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ivshmem-tools-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-gluster - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-s390x-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-curses-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-spice-core - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-alsa - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-vhost-user-gpu-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-lang - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-nfs - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-ssh-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ksm - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-usb-redirect-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-s390x - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-virtio-gpu-pci - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-tools - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-dmg - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-extra - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-gtk-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-opengl-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-dmg-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-usb-smartcard-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-opengl - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-spice-app - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-spice-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-gtk - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-linux-user-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-guest-agent-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-virtio-gpu-pci-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-usb-smartcard - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ppc - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-virtio-vga - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-tools-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-gluster-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-iscsi-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-spice - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-usb-redirect - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-curl - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-vhost-user-gpu - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-virtio-vga-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-linux-user - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-chardev-baum - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-curses - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-kvm - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-microvm - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-SLOF - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-skiboot - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-rbd-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-rbd - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-arm-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-curl-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-x86 - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-spice-app-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-virtio-gpu-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-chardev-spice - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-pa - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-qxl - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-linux-user-debugsource - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-alsa-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-debugsource - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-ssh - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-extra-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-x86-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-block-nfs-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ppc-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-display-virtio-gpu - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ivshmem-tools - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-ui-spice-core-debuginfo - addressed in versions 5.2.0-150300.138.1, 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-testsuite - update to 5.2.0-150300.138.2
qemu (Ubuntu package) - addressed in versions 1:6.2+dfsg-2ubuntu6.27, 1:8.2.2+ds-0ubuntu1.10, 1:9.2.1+ds-1ubuntu5.2
qemu-block-curl - addressed in versions 6.2.0-99, 8.2.0-18
qemu-block-ssh - addressed in versions 6.2.0-99, 8.2.0-18
qemu-img - addressed in versions 6.2.0-99, 8.2.0-18
qemu-system-aarch64 - addressed in versions 6.2.0-99, 8.2.0-18
qemu-system-arm - addressed in versions 6.2.0-99, 8.2.0-18
qemu-system-riscv - addressed in versions 6.2.0-99, 8.2.0-18
qemu-system-x86_64 - addressed in versions 6.2.0-99, 8.2.0-18
qemu-help - addressed in versions 6.2.0-99, 8.2.0-18
qemu-seabios - addressed in versions 6.2.0-99, 8.2.0-18
qemu - addressed in versions 6.2.0-99, 8.2.0-18
qemu-block-iscsi - addressed in versions 6.2.0-99, 8.2.0-18
qemu-block-rbd - addressed in versions 6.2.0-99, 8.2.0-18
qemu-debuginfo - addressed in versions 6.2.0-99, 8.2.0-18
qemu-debugsource - addressed in versions 6.2.0-99, 8.2.0-18
qemu-guest-agent - addressed in versions 6.2.0-99, 8.2.0-18
qemu-hw-usb-host - addressed in versions 6.2.0-99, 8.2.0-18
qemu-accel-tcg-x86-debuginfo - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-accel-tcg-x86 - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-jack-debuginfo - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-oss - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-accel-qtest - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-jack - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-accel-qtest-debuginfo - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-oss-debuginfo - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-usb-host - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-hw-usb-host-debuginfo - addressed in versions 6.2.0-150400.37.46.1, 7.1.0-150500.49.36.2
qemu-audio-dbus-debuginfo - update to 7.1.0-150500.49.36.2
qemu-ui-dbus - update to 7.1.0-150500.49.36.2
qemu-audio-dbus - update to 7.1.0-150500.49.36.2
qemu-headless - update to 7.1.0-150500.49.36.2
qemu-ui-dbus-debuginfo - update to 7.1.0-150500.49.36.2
qemu-sgabios - addressed in versions 8-150300.138.1, 8-150400.37.46.1, 8-150500.49.36.2

• https://access.redhat.com/security/cve/CVE-2024-6505
• https://bugzilla.redhat.com/show_bug.cgi?id=2295760

• Denial of service in QEMU virtio-net device
• openEuler 22.03 LTS SP1 update for qemu
• openEuler 22.03 LTS SP4 update for qemu
• openEuler 24.03 LTS update for qemu
• openEuler 22.03 LTS SP3 update for qemu
• Ubuntu update for qemu
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu