QEMU virtio-net: guest-controlled RSS indirection table indexes out of bounds and crashes the host QEMU process

CVSS 6.8CVE-2024-6505Kernel, userspace & hypervisorcurated

Impact

With RSS enabled on a virtio-net NIC, the guest controls the RSS indirections_table contents. Oversized values index out of bounds and reach heap memory outside the intended array, which Red Hat describes as letting a privileged guest user crash the QEMU process on the host. For a GPU cloud that hands tenants full VMs, that is a tenant-triggered kill of their own VM - and of whatever shared state that QEMU instance held - with the host-side heap corruption being the part worth not finding out about the hard way. Confidentiality and integrity are rated none; the established outcome is availability.

Who can reach it

Privileged (root-equivalent) user inside a guest VM whose virtio-net device has RSS enabled. No host access and no network reachability needed beyond being that guest.

What to do

Apply the patched qemu-kvm from your distribution (see the Red Hat tracker for per-release errata). The running QEMU process keeps the old code, so each guest must be restarted or live-migrated onto a patched host - plan a rolling drain. Interim mitigation: disable the RSS feature on virtio-net devices for untrusted guests.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-6505 https://access.redhat.com/security/cve/CVE-2024-6505 https://bugzilla.redhat.com/show_bug.cgi?id=2295760 https://security.netapp.com/advisory/ntap-20240816-0006/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.