CVE-2024-7409

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.(CVE-2024-7409)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.(CVE-2024-7409)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.(CVE-2024-7409)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.(CVE-2024-7409)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.(CVE-2024-7409)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)

• QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)

• libnbd: NBD server improper certificate validation (CVE-2024-7383)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)
• QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)
• libnbd: NBD server improper certificate validation (CVE-2024-7383)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow (CVE-2024-26327)
• QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)
• QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

• CVE-2024-7409: fix improper synchronization during socket closure to prevent DoS attack

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU. (CVE-2023-1544) A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. (CVE-2023-3019) A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the inflate_buffer function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. (CVE-2023-3255) A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot. (CVE-2023-5088) A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683) A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the out_sg variable could be used to read a part of process memory and send it to the wire, causing an information leak. (CVE-2023-6693) QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately. (CVE-2023-42467) QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len. (CVE-2024-24474) An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations. (CVE-2024-26327) An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328) A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host. (CVE-2024-3446) A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both s->data_count and the size of s->fifo_buffer are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. (CVE-2024-3447) A flaw…

These are all security issues fixed in the qemu-9.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow (CVE-2024-26327)

• QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)

• QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

This update for qemu fixes the following issues:

• CVE-2024-4467: Fixed denial of service and file read/write via qemu-img info command (bsc#1227322)

• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)

  • nbd/server: Close stray clients at server-stop
  • nbd/server: Drop non-negotiating clients
  • nbd/server: Cap default max-connections to 100
  • nbd/server: Plumb in new args to nbd_client_add()
  • nbd: Minor style and typo fixes

• Update qemu to version 8.2.6

This update for qemu fixes the following issues:

Security fixes:

• CVE-2024-8354: Fixed assertion failure in usb_ep_get() (bsc#1230834)
• CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915)

Update version to 8.2.7:

Security fixes:

• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)
• CVE-2024-4693: Fixed improper release of configure vector in virtio-pci that lead to guest triggerable crash (bsc#1224132)

Other fixes:

• added missing fix for ppc64 emulation that caused corruption in userspace (bsc#1230140)
• target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)
• accel/kvm: check for KVM_CAP_READONLY_MEM on VM (bsc#1231519)

Full changelog here:

https://lore.kernel.org/qemu-devel/[email protected]/

This update for qemu fixes the following issues:

• CVE-2024-8354: Fixed assertion failure in usb_ep_get() (bsc#1230834).
• CVE-2024-8612: Fixed nformation leak in virtio devices (bsc#1230915).
• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007).

This update for qemu fixes the following issues:

Security fixes:

• CVE-2024-8354: Fixed assertion failure in usb_ep_get() (bsc#1230834)
• CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915)

Update version to 8.2.7:

Security fixes:

• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)
• CVE-2024-4693: Fixed improper release of configure vector in virtio-pci that lead to guest triggerable crash (bsc#1224132)

Other fixes:

• added missing fix for ppc64 emulation that caused corruption in userspace (bsc#1230140)
• target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)
• accel/kvm: check for KVM_CAP_READONLY_MEM on VM (bsc#1231519)

Full changelog here:

https://lore.kernel.org/qemu-devel/[email protected]/

This update for qemu fixes the following issues:

• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)
• CVE-2024-8354: Fixed assertion failure in usb_ep_get() in usb (bsc#1230834)
• CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915)

This update for qemu fixes the following issues:

• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)

This update for qemu fixes the following issues:

• CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915).
• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007).
• CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845).

Other fixes:

• Fix ipxe build with new binutils (bsc#1219733, bsc#1219722).

This update for qemu fixes the following issues:

• Fix bsc#1221812:

  • block: Reschedule query-block during qcow2 invalidation (bsc#1221812)

• Fix bsc#1229007, CVE-2024-7409:

  • nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
  • nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
  • nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
  • nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
  • nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

• Update to version 8.2.6:

  Full backport lists (from the various releases) here: https://lore.kernel.org/qemu-devel/[email protected]/

  Some of the upstream backports are: hw/nvme: fix number of PIDs for FDP RUH update sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments char-stdio: Restore blocking mode of stdout on exit virtio: remove virtio_tswap16s() call in vring_packed_event_read() virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one() block: Parse filenames only when explicitly requested iotests/270: Don't store data-file with json: prefix in image iotests/244: Don't store data-file with protocol in image qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467) target/arm: Fix FJCVTZS vs flush-to-zero target/arm: Fix VCMLA Dd, Dn, Dm[idx] i386/cpu: fixup number of addressable IDs for processor cores in the physical package tests: Update our CI to use CentOS Stream 9 instead of 8 migration: Fix file migration with fdset tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers target/sparc: use signed denominator in sdiv helper linux-user: Make TARGET_NR_setgroups affect only the current thread accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded stdvga: fix screen blanking hw/audio/virtio-snd: Always use little endian audio format ui/gtk: Draw guest frame at refresh cycle virtio-net: drop too short packets early target/i386: fix size of EBP writeback in gen_enter()

This update for qemu fixes the following issues:

• Bugfixes and CVEs:

  • hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354)
  • softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612)
  • system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612)
  • system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612)
  • system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612)

• Update version to 8.2.7

  • Full changelog here: https://lore.kernel.org/qemu-devel/[email protected]/
  • Fixes: bsc#1229007, CVE-2024-7409 bsc#1224132, CVE-2024-4693
  • Some backports: gitlab: fix logic for changing docker tag on stable branches ui/sdl2: set swap interval explicitly when OpenGL is enabled hw/intc/arm_gic: fix spurious level triggered interrupts hw/audio/virtio-sound: fix heap buffer overflow tests/docker: update debian i686 and mipsel images to bookworm tests/docker: remove debian-armel-cross hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read() crypto: check gnutls & gcrypt support the requested pbkdf hash crypto: run qcrypto_pbkdf2_count_iters in a new thread softmmu/physmem: fix memory leak in dirty_memory_extend() target/ppc: Fix migration of CPUs with TLB_EMB TLB type gitlab: migrate the s390x custom machine to 22.04 target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64 hw/audio/virtio-snd: fix invalid param check virtio-pci: Fix the use of an uninitialized irqfd

• Fix bsc#1231519:

  • accel/kvm: check for KVM_CAP_READONLY_MEM on VM (bsc#1231519)

It was discovered that QEMU incorrectly handled certain virtio devices. A privileged guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)

It was discovered that QEMU incorrectly handled SDHCI device emulation. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3447)

It was discovered that QEMU incorrectly handled calculating the checksum of a short-sized fragmented packet. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)

It was discovered that the QEMU qemu-img utility incorrectly handled certain crafted image files. An attacker could use this issue to cause QEMU to consume resources, leading to a denial of service, or possibly read and write to an existing external file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-4467)

It was discovered that QEMU incorrectly handled the RSS feature on virtio-net devices. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)

It was discovered that QEMU incorrectly handled the NBD server. An attacker could use this issue to cause QEMU to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-7409)

It was discovered that QEMU incorrectly handled certain USB devices. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-8354)

It was discovered that the QEMU package incorrectly set up a binfmt_misc registration with the C (Credential) flag. A local attacker could use this with a suid/sgid binary to escalate privileges. This update will no longer run foreign-architecture binaries with suid/sgid with elevated privileges.

USN-8412-1 fixed vulnerabilities in QEMU. On both Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, the fix for CVE-2024-7409 was incomplete and resulted in a regression that could cause qemu-nbd to crash when a client connected. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)

It was discovered that the iSCSI block driver in QEMU incorrectly handled certain memory operations, leading to a heap-based buffer over-read. An attacker could possibly use this issue to expose sensitive information from the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)

Ziming Zhang discovered that the SM501 display driver in QEMU contained an integer overflow. A local attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-12829)

Gaoning Pan and Xingwei Li discovered that the USB xHCI controller implementation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2020-14394)

Lei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps objects, leading to a NULL pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-15469)

Alexander Bulekov discovered that the e1000e network device implementation in QEMU contained a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)

Ziming Zhang discovered that the XGMAC Ethernet controller in QEMU contained a buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15863)

Alexander Bulekov discovered that the SDHCI device emulation in QEMU contained a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-17380)

Sergej Schumilo, Cornelius Aschermann, and Simon Wörner discovered that the USB xHCI controller implementation in QEMU did not check a return value, leading to a use-after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25084)

Gaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI controller implementation in QEMU contained a stack-based buffer over-read. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25624)

It was discovered that the USB OHCI controller implementation in QEMU contained an infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)

Cheolwoo Myung discovered that the USB EHCI emulation in QEMU did not handle DMA memory map failures, leading to a reachable assertion. An attacker inside the guest could…