CVE-2024-6505
Fixed in a distro release EPSS <1%CVSS 6.8
A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | qemu | 11.0.1-r0 |
| Chainguard | qemu-block-iscsi | 11.0.1-r0 |
| Chainguard | qemu-block-rbd | 11.0.1-r0 |
| Chainguard | qemu-edk2-aarch64 | 11.0.1-r0 |
| Chainguard | qemu-edk2-x86_64 | 11.0.1-r0 |
| Chainguard | qemu-ipxe | 11.0.1-r0 |
| Chainguard | qemu-modules | 11.0.1-r0 |
| Chainguard | qemu-modules-spice | 11.0.1-r0 |
| Chainguard | qemu-modules-usb-host | 11.0.1-r0 |
| Chainguard | qemu-system-aarch64 | 11.0.1-r0 |
| Chainguard | qemu-system-x86_64 | 11.0.1-r0 |
| Chainguard | qemu-user | 11.0.1-r0 |
| Chainguard | qemu-user-binfmt | 11.0.1-r0 |
| Chainguard | qemu-utils | 11.0.1-r0 |
| Debian 12 | qemu | 1:7.2+dfsg-7+deb12u8 |
| Debian 13 | qemu | 1:9.0.2+ds-3 |
| Debian 14 | qemu | 1:9.0.2+ds-3 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | qemu | 6.2.0-150400.37.46.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | qemu | 6.2.0-150400.37.46.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | qemu | 7.1.0-150500.49.36.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | qemu | 7.1.0-150500.49.36.2 |
| SUSE Linux Enterprise Micro 5.2 | qemu | 5.2.0-150300.138.1 |
| SUSE Linux Enterprise Micro 5.3 | qemu | 6.2.0-150400.37.46.1 |
| SUSE Linux Enterprise Micro 5.4 | qemu | 6.2.0-150400.37.46.1 |
| SUSE Linux Enterprise Micro 5.5 | qemu | 7.1.0-150500.49.36.2 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | qemu | 7.1.0-150500.49.36.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | qemu | 6.2.0-150400.37.46.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | qemu | 7.1.0-150500.49.36.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | qemu | 6.2.0-150400.37.46.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | qemu | 7.1.0-150500.49.36.2 |
| SUSE Manager Proxy LTS 4.3 | qemu | 6.2.0-150400.37.46.1 |
| SUSE Manager Server LTS 4.3 | qemu | 6.2.0-150400.37.46.1 |
| Ubuntu 22.04 LTS | qemu | 1:6.2+dfsg-2ubuntu6.27 |
| Ubuntu 24.04 LTS | qemu | 1:8.2.2+ds-0ubuntu1.10 |
| Wolfi | qemu | 11.0.1-r0 |
| Wolfi | qemu-block-iscsi | 11.0.1-r0 |
| Wolfi | qemu-block-rbd | 11.0.1-r0 |
| Wolfi | qemu-edk2-aarch64 | 11.0.1-r0 |
| Wolfi | qemu-edk2-x86_64 | 11.0.1-r0 |
| Wolfi | qemu-ipxe | 11.0.1-r0 |
| Wolfi | qemu-modules | 11.0.1-r0 |
| Wolfi | qemu-modules-spice | 11.0.1-r0 |
| Wolfi | qemu-modules-usb-host | 11.0.1-r0 |
| Wolfi | qemu-system-aarch64 | 11.0.1-r0 |
| Wolfi | qemu-system-x86_64 | 11.0.1-r0 |
| Wolfi | qemu-user | 11.0.1-r0 |
| Wolfi | qemu-user-binfmt | 11.0.1-r0 |
| Wolfi | qemu-utils | 11.0.1-r0 |