CVE-2024-4693
Publication date 14 May 2024
Last updated 24 July 2024
Ubuntu priority
A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| qemu | 24.10 oracular |
Fixed 1:9.0.2+ds-4ubuntu2
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Notes
mdeslaur
per Debian, introduced in 8.0.0-rc0 with the following commit: https://gitlab.com/qemu-project/qemu/-/commit/f9a09ca3ea69d108d828b7c82f1bd61b2df6fc96 original fix was incomplete, see bugs