CVE-2024-4693

Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash

State: Published
Severity: 5.5 Medium
Published: May 10, 2024
Updated: Nov 8, 2025
Reserved: May 9, 2024

Description

A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-672 Operation on a Resource after Expiration or Release

Affected Products

Product	Versions
qemu	7eeb62b0ce3a8f64647bf53f93903abd1fbb0b94 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 8 Advanced VirtualizationRed Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2024-4693vdb-entry
RHBZ#2279965issue-tracking
https://security.netapp.com/advisory/ntap-20240828-0007/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.