CVE-2024-4693
qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 10, 2024
Updated · June 28, 2026
Description
A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-672 · Operation on a Resource after Expiration or Release