CVE-2024-6505

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

This flaw has been rated as Moderate because it can only be exploited by privileged users within the guest.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A viable mitigation for this vulnerability is to disable RSS on the nic/virtio driver. This can be performed either with the following qemu-kvm command "-device virtio-net-pci,rss=off", or, alternatively, by directly modifying the KVM XML file to disable RSS using a standard configuration tool (ex. libvirt).