Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-4693: QEMU can be crashed by a malicious virtual machine
CVE-2024-4693 · published 2 years ago
Summary
The virtualization software QEMU has a mistake that lets a guest operating system cause the host’s QEMU process to stop working during startup. This can lead to service interruptions for any workloads running on that host. Apply the latest QEMU update or the vendor’s patch to fix the issue and restart the host after updating.
What to do
- Update debian qemu to version 1:8.2.3+ds-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | qemu |
< 1:8.2.3+ds-1 Fix: upgrade to 1:8.2.3+ds-1
|
| Debian:14 | debian | qemu |
< 1:8.2.3+ds-1 Fix: upgrade to 1:8.2.3+ds-1
|
Original advisory text
A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost...
A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-672Operation on a Resource after Expiration or Release
Timeline
Published14 May 2024
Updated31 Oct 2026
First seen1 Sep 2026
Track software like this
Free during beta