QEMU: guest-triggerable assertion failure in USB endpoint lookup crashes the VM process

CVSS 5.5CVE-2024-8354Kernel, userspace & hypervisorcurated

Impact

An unprivileged user inside a guest can trigger an assertion failure in QEMU's usb_ep_get() path and crash the QEMU process on the host. The blast radius is the affected virtual machine, not the hypervisor or neighbouring guests, but on a GPU node that VM may hold passthrough accelerators and an in-flight training or serving workload, so the crash costs a restart and whatever state was not checkpointed. Red Hat scores it 5.5, availability-only. Guests without emulated USB devices are not exposed.

Who can reach it

Local unprivileged user inside a guest VM that has emulated USB devices attached; no host access needed.

What to do

Install the QEMU update from your distribution (Red Hat has advisories for RHEL 6 through 10 and RHEL 8 Advanced Virtualization). The fix only takes effect for a VM once its QEMU process is replaced, so each guest must be live-migrated or restarted - plan a drain of GPU nodes running affected guests. Removing unused emulated USB controllers from guest definitions removes the exposure in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-8354 https://access.redhat.com/security/cve/CVE-2024-8354 https://bugzilla.redhat.com/show_bug.cgi?id=2313497 https://security.netapp.com/advisory/ntap-20241011-0008/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.