CVE-2024-6519

qemu-kvm: lsi53c895a: use-after-free local privilege escalation vulnerability

Loading…

Severity

Important

Red Hat Product Security

8.2

CVSS 3.1

Review impact separately from score.

Published · October 10, 2024

Updated · June 28, 2026

Description

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

Statement

The qemu-kvm packages shipped in Red Hat Enterprise Linux and RHEL Advanced Virtualization are not affected by this issue because the LSI53C895A device is not enabled.

Additionally, LSI53C895A emulation is not used for virtualized production services. Therefore, it is unlikely to be used in association with untrusted guests.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE-416 · Use After Free