Bug 2274211 (CVE-2024-3446) - CVE-2024-3446 QEMU: virtio: DMA reentrancy issue leads to double free vulnerability
Summary: CVE-2024-3446 QEMU: virtio: DMA reentrancy issue leads to double free vulnera...
Keywords:
Status: NEW
Alias: CVE-2024-3446
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2274212
Blocks: 1997699
TreeView+ depends on / blocked
 
Reported: 2024-04-09 18:30 UTC by Mauro Matteo Cascella
Modified: 2024-11-12 08:56 UTC (History)
12 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:6964 0 None None None 2024-09-24 03:22:46 UTC
Red Hat Product Errata RHSA-2024:9136 0 None None None 2024-11-12 08:56:06 UTC

Description Mauro Matteo Cascella 2024-04-09 18:30:12 UTC
It was found that the mem_reentrancy_guard flag did not sufficiently protect against DMA reentrancy issues in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), leading to a double free vulnerability. A malicious privileged guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host.

Upstream patch:
https://patchew.org/QEMU/20240409105537.18308-1-philmd@linaro.org/

Comment 1 Mauro Matteo Cascella 2024-04-09 18:30:39 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2274212]

Comment 3 Mauro Matteo Cascella 2024-04-09 18:35:24 UTC
While QEMU is an essential component in virtualization environments, it is not intended to be used directly on RHEL systems due to security concerns. In other words, using qemu-kvm commands is not currently supported by Red Hat (https://access.redhat.com/solutions/408653). It is highly recommended to interact with QEMU by using libvirt, which provides several isolation mechanisms to realize guest isolation and the principle of least privilege. The fundamental isolation mechanism is that QEMU processes on the host are run as unprivileged users. Also, the libvirtd daemon sets up additional sandbox around QEMU by leveraging SELinux and sVirt protection for QEMU guests, which further limits the potential damage in case of guest-to-host escape scenario. The impact of this flaw is therefore limited (Moderate) under such circumstances.

Comment 4 errata-xmlrpc 2024-09-24 03:22:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6964 https://access.redhat.com/errata/RHSA-2024:6964

Comment 5 errata-xmlrpc 2024-11-12 08:56:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9136 https://access.redhat.com/errata/RHSA-2024:9136


Note You need to log in before you can comment on or make changes to this bug.