{"id":"CVE-2024-6505","aliases":["AZL-60070","AZL-60925","DEBIAN-CVE-2024-6505","EUVD-2024-47589","GHSA-3qx7-ff8p-6j2r","OESA-2024-2199","OESA-2024-2200","OESA-2024-2201","OESA-2024-2240","SUSE-SU-2026:0039-1","SUSE-SU-2026:0043-1","SUSE-SU-2026:0070-1","UBUNTU-CVE-2024-6505","USN-7744-1"],"status":"published","title":"Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00656,"percentile":0.51684,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-07-05T13:51:38Z","modified":"2026-11-07T00:31:17Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-24"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-16"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:9.0.2+ds-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:9.0.2+ds-3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"qemu","fixed_in":["8.2.0-18.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","fixed_in":["6.2.0-99.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","fixed_in":["6.2.0-99.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","fixed_in":["6.2.0-99.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-24"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u8"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1","1:7.2+dfsg-7+deb12u3","1:7.2+dfsg-7+deb12u4","1:7.2+dfsg-7+deb12u5","1:7.2+dfsg-7+deb12u6","1:7.2+dfsg-7+deb12u7"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.2+ds-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.2+ds-3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-18.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-99.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-99.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-99.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.138.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.27"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.10"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.27"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.10"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9"],"bundled":7}],"products":[{"vendor":"qemu","product":"qemu"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8 advanced virtualization"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-6505","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295760","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240816-0006/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6505","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240816-0006"},{"url":"https://github.com/advisories/GHSA-3qx7-ff8p-6j2r"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6505.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6505","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2199","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2200","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2201","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2240","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260039-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227397","tags":["report"]},{"url":"https://bugzilla.suse.com/1250984","tags":["report"]},{"url":"https://bugzilla.suse.com/1252768","tags":["report"]},{"url":"https://bugzilla.suse.com/1253002","tags":["report"]},{"url":"https://bugzilla.suse.com/1254286","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260043-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1209554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1544","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260070-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-6505","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6505","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7744-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-7409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8354","tags":["report"]},{"url":"https://bugs.launchpad.net/bugs/2120814","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-6505","title":"Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T13:51:38.241Z","modified":"2026-11-06T22:43:17.386Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T23:31:36.933174Z"}],"euvd":[{"id":"EUVD-2024-47589","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T13:51:38Z","modified":"2026-11-06T22:43:17Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T00:07:44.018381Z"}],"ghsa":[{"id":"GHSA-3qx7-ff8p-6j2r","title":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio...","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T15:32:06Z","modified":"2026-11-07T00:31:17Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T00:35:05.949844Z"}],"nvd":[{"id":"CVE-2024-6505","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T14:15:03.42Z","modified":"2026-11-06T23:17:18.967Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T02:02:49.762113Z"}],"osv":[{"id":"AZL-60070","title":"CVE-2024-6505 affecting package qemu for versions less than 6.2.0-24","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T14:15:03Z","modified":"2026-04-21T04:37:22.04012Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-60925","title":"CVE-2024-6505 affecting package qemu for versions less than 8.2.0-16","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T14:15:03Z","modified":"2026-04-21T04:51:56.202217Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"CVE-2024-6505","title":"Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T13:51:38.241Z","modified":"2026-11-08T02:30:53.31534252Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T11:15:41.683306Z"},{"id":"DEBIAN-CVE-2024-6505","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T14:15:03.42Z","modified":"2026-11-07T09:47:37.894532698Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2024-2199","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.(CVE-2024-6505)","status":"published","published":"2024-09-27T11:07:40Z","modified":"2026-08-18T01:18:37.178974226Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2200","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.(CVE-2024-6505)","status":"published","published":"2024-09-27T11:07:40Z","modified":"2026-08-18T01:18:36.985942685Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2201","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.(CVE-2024-6505)","status":"published","published":"2024-09-27T11:07:40Z","modified":"2026-08-18T01:18:37.233723239Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2240","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.(CVE-2024-6505)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:35.497935458Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-6505","description":"A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.","status":"published","published":"2024-07-05T14:15:00Z","modified":"2026-02-04T02:40:52.859856Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"SUSE-SU-2026:0039-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-6505: qemu-kvm: virtio-net: Fixed queue index \n  out-of-bounds access in software RSS (bsc#1227397)\n- CVE-2025-12464: net: pad packets to minimum length in \n  qemu_receive_packet() (bsc#1253002)\n- CVE-2025-11234: qemu-kvm: Fixed use-after-free in websocket \n  handshake code leading to denial of service (bsc#1250984)\n\nOther fixes:\n- Fixed *-virtio-gpu-pci dependency on ARM (bsc#1254286)\n- block/curl: Fixed curl internal handles handling (bsc#1252768)\n","status":"published","published":"2026-01-06T10:31:23Z","modified":"2026-03-23T04:51:53.779083Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0043-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-1544: out-of-bounds read in VMWare's paravirtual RDMA device operations can be exploited through a malicious\n  guest driver to crash the QEMU process on the host (bsc#1209554).\n- CVE-2024-6505: heap-based buffer overflow in the virtio-net device operations can be exploited by a malicious\n  privileged user to crash the QEMU process on the host (bsc#1227397).\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n\nOther updates and bugfixes: \n  \n- [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.\n- [openSUSE][RPM} spec: delete old specfile constructs.\n- block/curl: fix curl internal handles handling (bsc#1252768).\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n","status":"published","published":"2026-01-06T16:03:07Z","modified":"2026-02-04T03:05:12.391355Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0070-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-6505: Fixed queue index out-of-bounds access in software RSS (bsc#1227397)\n- CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554)\n","status":"published","published":"2026-01-08T13:21:59Z","modified":"2026-02-04T02:56:52.231511Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"USN-7744-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU incorrectly handled certain virtio devices. A\nprivileged guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)\n\nIt was discovered that QEMU incorrectly handled SDHCI device emulation. A\nguest attacker could possibly use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 24.04 LTS. (CVE-2024-3447)\n\nIt was discovered that QEMU incorrectly handled calculating the checksum\nof a short-sized fragmented packet. A guest attacker could possibly use\nthis issue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)\n\nIt was discovered that the QEMU qemu-img utility incorrectly handled\ncertain crafted image files. An attacker could use this issue to cause QEMU\nto consume resources, leading to a denial of service, or possibly read and\nwrite to an existing external file. This issue only affected Ubuntu 22.04\nLTS and Ubuntu 24.04 LTS. (CVE-2024-4467)\n\nIt was discovered that QEMU incorrectly handled the RSS feature on\nvirtio-net devices. A privileged guest attacker could possibly use this\nissue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)\n\nIt was discovered that QEMU incorrectly handled the NBD server. An attacker\ncould use this issue to cause QEMU to consume resources, leading to a\ndenial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2024-7409)\n\nIt was discovered that QEMU incorrectly handled certain USB devices. A\nguest attacker could possibly use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 24.04 LTS. (CVE-2024-8354)\n\nIt was discovered that the QEMU package incorrectly set up a binfmt_misc\nregistration with the C (Credential) flag. A local attacker could use this\nwith a suid/sgid binary to escalate privileges. This update will no longer\nrun foreign-architecture binaries with suid/sgid with elevated privileges.","status":"published","published":"2025-09-11T12:41:28Z","modified":"2026-04-27T18:33:14.837287259Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}