Bugzilla – Bug 1224132
VUL-0: CVE-2024-4693: qemu: virtio-pci: improper release of configure vector leads to guest triggerable crash
Last modified: 2024-07-09 05:45:31 UTC
A flaw was found in QEMU in the Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). The original patch [1] was found to be incomplete and is currently being reworked upstream [2][3]. [1] https://gitlab.com/qemu-project/qemu/-/commit/fcbb086ae590e910614fe5b8bf76e264f71ef304 [2] https://gitlab.com/qemu-project/qemu/-/issues/2321 [3] https://gitlab.com/qemu-project/qemu/-/issues/2334 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4693 https://bugzilla.redhat.com/show_bug.cgi?id=2279965
As per the vulnerability description, it exists due to an incomplete fix [0] that was applied to qemu. This incomplete fix [0] is an attempt to correct problems that were introduced with the functionalities added through commit f9a09ca3 [1]. The incomplete fix [0] was introduced in version 8.2.3, while commit f9a09ca3 [1] was introduced in version 8.0.0. Package qemu at versions below 8.2.3 are not affected by the issue described by this CVE specifically, however, certain codestreams which contain package qemu at a version that is between 8.0.0 and 8.2.3 are affected by the issue that [0] is attempting to fix. [0] https://gitlab.com/qemu-project/qemu/-/commit/2ce6cff94df2650c460f809e5ad263f1d22507c0 [1] https://gitlab.com/qemu-project/qemu/-/commit/f9a09ca3ea69d108d828b7c82f1bd61b2df6fc96
(In reply to Camila Camargo de Matos from comment #1) > As per the vulnerability description, it exists due to an incomplete fix [0] > that was applied to qemu. This incomplete fix [0] is an attempt to correct > problems that were introduced with the functionalities added through commit > f9a09ca3 [1]. > > The incomplete fix [0] was introduced in version 8.2.3, while commit > f9a09ca3 [1] was introduced in version 8.0.0. > > Package qemu at versions below 8.2.3 are not affected by the issue described > by this CVE specifically, however, certain codestreams which contain package > qemu at a version that is between 8.0.0 and 8.2.3 are affected by the issue > that [0] is attempting to fix. > > [0] > https://gitlab.com/qemu-project/qemu/-/commit/ > 2ce6cff94df2650c460f809e5ad263f1d22507c0 > [1] > https://gitlab.com/qemu-project/qemu/-/commit/ > f9a09ca3ea69d108d828b7c82f1bd61b2df6fc96 Ok, the fix should be this patches: https://lore.kernel.org/qemu-devel/20240702020033.139261-1-lulu@redhat.com/ I'm not sure why/how the first one appears to be upstream commit https://gitlab.com/qemu-project/qemu/-/commit/7eeb62b0ce3a8f64647bf53f93903abd1fbb0b94 (it's mentioned as such even here: https://bugzilla.redhat.com/show_bug.cgi?id=2279965), because I don't actually see in the tree yet... Maybe it is/was in a branch or there's something else I'm missing. Anyway, the patch is still being discussed in the ML. I'll keep an eye out for it.