Operation on a Resource after Expiration or Release in QEMU - CVE-2024-4693

Vulnerability identifier: #VU94528

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4693

CWE-ID: CWE-672

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to an improper release and use of the irqfd for vector 0 during the boot process in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). A malicious guest can crash the QUEMU host process via vhost_net_stop().

QEMU
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Ubuntu
Basesystem Module
SUSE Package Hub 15
Server Applications Module
Confidential Computing Module
openSUSE Leap
Anolis OS
qemu-system-common (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-system-x86-microvm (Ubuntu package)
qemu-block-dmg
qemu-block-curl
qemu-audio-spice
qemu-audio-pa
qemu-audio-oss
qemu-audio-dbus
qemu-audio-alsa
qemu
qemu-user-binfmt
qemu-system-x86-core
qemu-pr-helper
qemu-system-aarch64
qemu-system-aarch64-core
qemu-system-arm
qemu-system-arm-core
qemu-system-loongarch64
qemu-system-loongarch64-core
qemu-system-riscv
qemu-system-riscv-core
qemu-system-x86
qemu-block-iscsi
qemu-tests
qemu-tools
qemu-ui-curses
qemu-ui-dbus
qemu-ui-egl-headless
qemu-ui-gtk
qemu-ui-opengl
qemu-ui-spice-app
qemu-ui-spice-core
qemu-user
qemu-device-usb-smartcard
qemu-device-display-virtio-gpu
qemu-device-display-qxl
qemu-device-display-virtio-gpu-ccw
qemu-device-display-virtio-gpu-pci
qemu-device-display-virtio-vga
qemu-device-display-virtio-vga-gl
qemu-common
qemu-char-spice
qemu-device-usb-host
qemu-device-usb-redirect
qemu-docs
qemu-char-baum
qemu-guest-agent
qemu-block-ssh
qemu-img
qemu-block-gluster
qemu-kvm
qemu-kvm-core
qemu-system-xen (Ubuntu package)
qemu-hw-usb-host-debuginfo
qemu-pr-helper-debuginfo
qemu-hw-usb-host
qemu-img-debuginfo
qemu-block-curl-debuginfo
qemu-x86-debuginfo
qemu-headless
qemu-audio-pa-debuginfo
qemu-ui-gtk-debuginfo
qemu-block-iscsi-debuginfo
qemu-audio-pipewire-debuginfo
qemu-block-ssh-debuginfo
qemu-ui-dbus-debuginfo
qemu-accel-tcg-x86-debuginfo
qemu-block-rbd-debuginfo
qemu-ui-opengl-debuginfo
qemu-spice
qemu-chardev-spice-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-ui-spice-core-debuginfo
qemu-lang
qemu-audio-alsa-debuginfo
qemu-hw-usb-redirect
qemu-audio-dbus-debuginfo
qemu-ipxe
qemu-chardev-baum-debuginfo
qemu-block-nfs-debuginfo
qemu-block-rbd
qemu-chardev-baum
qemu-ksm
qemu-tools-debuginfo
qemu-SLOF
qemu-hw-display-virtio-vga-debuginfo
qemu-hw-display-virtio-gpu-pci
qemu-skiboot
qemu-hw-usb-redirect-debuginfo
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-hw-display-qxl-debuginfo
qemu-hw-display-virtio-gpu
qemu-audio-pipewire
qemu-guest-agent-debuginfo
qemu-block-nfs
qemu-debuginfo
qemu-hw-display-virtio-vga
qemu-ui-spice-app-debuginfo
qemu-x86
qemu-audio-spice-debuginfo
qemu-debugsource
qemu-ui-curses-debuginfo
qemu-hw-display-qxl
qemu-accel-tcg-x86
qemu-chardev-spice
qemu-arm
qemu-s390x
qemu-block-gluster-debuginfo
qemu-audio-oss-debuginfo
qemu-linux-user-debugsource
qemu-s390x-debuginfo
qemu-accel-qtest
qemu-linux-user-debuginfo
qemu-doc
qemu-microvm
qemu-hw-usb-smartcard-debuginfo
qemu-extra
qemu-hw-s390x-virtio-gpu-ccw
qemu-ivshmem-tools
qemu-ppc
qemu-extra-debuginfo
qemu-hw-usb-smartcard
qemu-audio-jack
qemu-arm-debuginfo
qemu-vhost-user-gpu-debuginfo
qemu-accel-qtest-debuginfo
qemu-ivshmem-tools-debuginfo
qemu-linux-user
qemu-vhost-user-gpu
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-ppc-debuginfo
qemu-audio-jack-debuginfo
qemu-block-dmg-debuginfo
qemu-seabios
qemu-vgabios

Install updates from vendor's website.

qemu-system-common (Ubuntu package) - update to Ubuntu Pro
qemu-system-x86 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-sparc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-s390x (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24
qemu-system (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-arm (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-ppc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-mips (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-misc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-aarch64 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24, 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.30, 1:6.2+dfsg-2ubuntu6.24
qemu-block-dmg - update to 8.2.0-19
qemu-block-curl - update to 8.2.0-19
qemu-audio-spice - update to 8.2.0-19
qemu-audio-pa - update to 8.2.0-19
qemu-audio-oss - update to 8.2.0-19
qemu-audio-dbus - update to 8.2.0-19
qemu-audio-alsa - update to 8.2.0-19
qemu - update to 8.2.0-19
qemu-user-binfmt - update to 8.2.0-19
qemu-system-x86-core - update to 8.2.0-19
qemu-pr-helper - update to 8.2.0-19
qemu-system-aarch64 - update to 8.2.0-19
qemu-system-aarch64-core - update to 8.2.0-19
qemu-system-arm - update to 8.2.0-19
qemu-system-arm-core - update to 8.2.0-19
qemu-system-loongarch64 - update to 8.2.0-19
qemu-system-loongarch64-core - update to 8.2.0-19
qemu-system-riscv - update to 8.2.0-19
qemu-system-riscv-core - update to 8.2.0-19
qemu-system-x86 - update to 8.2.0-19
qemu-block-iscsi - update to 8.2.0-19
qemu-tests - update to 8.2.0-19
qemu-tools - update to 8.2.0-19
qemu-ui-curses - update to 8.2.0-19
qemu-ui-dbus - update to 8.2.0-19
qemu-ui-egl-headless - update to 8.2.0-19
qemu-ui-gtk - update to 8.2.0-19
qemu-ui-opengl - update to 8.2.0-19
qemu-ui-spice-app - update to 8.2.0-19
qemu-ui-spice-core - update to 8.2.0-19
qemu-user - update to 8.2.0-19
qemu-device-usb-smartcard - update to 8.2.0-19
qemu-device-display-virtio-gpu - update to 8.2.0-19
qemu-device-display-qxl - update to 8.2.0-19
qemu-device-display-virtio-gpu-ccw - update to 8.2.0-19
qemu-device-display-virtio-gpu-pci - update to 8.2.0-19
qemu-device-display-virtio-vga - update to 8.2.0-19
qemu-device-display-virtio-vga-gl - update to 8.2.0-19
qemu-common - update to 8.2.0-19
qemu-char-spice - update to 8.2.0-19
qemu-device-usb-host - update to 8.2.0-19
qemu-device-usb-redirect - update to 8.2.0-19
qemu-docs - update to 8.2.0-19
qemu-char-baum - update to 8.2.0-19
qemu-guest-agent - update to 8.2.0-19
qemu-block-ssh - update to 8.2.0-19
qemu-img - update to 8.2.0-19
qemu-block-gluster - update to 8.2.0-19
qemu-kvm - update to 8.2.0-19
qemu-kvm-core - update to 8.2.0-19
qemu-system-xen (Ubuntu package) - addressed in versions 1:8.2.2+ds-0ubuntu1.4, 1:9.0.2+ds-4ubuntu5.1
qemu-hw-usb-host-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-img - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-curses - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-pr-helper-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-usb-host - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-tools - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-iscsi - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-img-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-curl-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-x86-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-headless - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-pa-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-spice-core - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-opengl - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-gtk-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-iscsi-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-pipewire-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-ssh-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-dbus-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-dbus - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-accel-tcg-x86-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-curl - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-ssh - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-rbd-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-opengl-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-spice - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-chardev-spice-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-pr-helper - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-virtio-gpu-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-spice-core-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-lang - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-alsa-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-usb-redirect - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-dbus-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-pa - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-gtk - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ipxe - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-chardev-baum-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-nfs-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-rbd - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-chardev-baum - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ksm - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-tools-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-SLOF - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-virtio-vga-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-virtio-gpu-pci - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-skiboot - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-usb-redirect-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-spice-app - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-virtio-gpu-pci-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-qxl-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-virtio-gpu - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-pipewire - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-spice - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-guest-agent-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-block-nfs - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-guest-agent - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-virtio-vga - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-spice-app-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-alsa - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-x86 - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-dbus - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-audio-spice-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-debugsource - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-ui-curses-debuginfo - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-hw-display-qxl - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-accel-tcg-x86 - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-chardev-spice - addressed in versions 8.2.7-15061.6.coco15sp6.1, 8.2.7-150600.3.20.1
qemu-arm - update to 8.2.7-150600.3.20.1
qemu-s390x - update to 8.2.7-150600.3.20.1
qemu-block-gluster-debuginfo - update to 8.2.7-150600.3.20.1
qemu-audio-oss-debuginfo - update to 8.2.7-150600.3.20.1
qemu-linux-user-debugsource - update to 8.2.7-150600.3.20.1
qemu-s390x-debuginfo - update to 8.2.7-150600.3.20.1
qemu-accel-qtest - update to 8.2.7-150600.3.20.1
qemu-linux-user-debuginfo - update to 8.2.7-150600.3.20.1
qemu-doc - update to 8.2.7-150600.3.20.1
qemu-microvm - update to 8.2.7-150600.3.20.1
qemu-hw-usb-smartcard-debuginfo - update to 8.2.7-150600.3.20.1
qemu-block-gluster - update to 8.2.7-150600.3.20.1
qemu-extra - update to 8.2.7-150600.3.20.1
qemu-hw-s390x-virtio-gpu-ccw - update to 8.2.7-150600.3.20.1
qemu-ivshmem-tools - update to 8.2.7-150600.3.20.1
qemu-ppc - update to 8.2.7-150600.3.20.1
qemu-extra-debuginfo - update to 8.2.7-150600.3.20.1
qemu-audio-oss - update to 8.2.7-150600.3.20.1
qemu-block-dmg - update to 8.2.7-150600.3.20.1
qemu-hw-usb-smartcard - update to 8.2.7-150600.3.20.1
qemu-audio-jack - update to 8.2.7-150600.3.20.1
qemu-arm-debuginfo - update to 8.2.7-150600.3.20.1
qemu-vhost-user-gpu-debuginfo - update to 8.2.7-150600.3.20.1
qemu-accel-qtest-debuginfo - update to 8.2.7-150600.3.20.1
qemu-ivshmem-tools-debuginfo - update to 8.2.7-150600.3.20.1
qemu-linux-user - update to 8.2.7-150600.3.20.1
qemu-vhost-user-gpu - update to 8.2.7-150600.3.20.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 8.2.7-150600.3.20.1
qemu-ppc-debuginfo - update to 8.2.7-150600.3.20.1
qemu-audio-jack-debuginfo - update to 8.2.7-150600.3.20.1
qemu-block-dmg-debuginfo - update to 8.2.7-150600.3.20.1
qemu-seabios - addressed in versions 8.2.71.16.3_3_ga95067eb-150600.3.20.1, 8.2.71.16.3_3_ga95067eb-15061.6.coco15sp6.1
qemu-vgabios - addressed in versions 8.2.71.16.3_3_ga95067eb-150600.3.20.1, 8.2.71.16.3_3_ga95067eb-15061.6.coco15sp6.1

• https://access.redhat.com/security/cve/CVE-2024-4693
• https://bugzilla.redhat.com/show_bug.cgi?id=2279965

• Denial of service in QEMU Virtio PCI Bindings
• SUSE update for qemu
• Ubuntu update for qemu
• SUSE update for qemu
• Anolis OS update for qemu