PT-2024-32284 · Qemu+4 · Qemu+4

Mauro Matteo Cascella · Published 2024-05-10 · Updated 2025-11-06 · CVE-2024-4693

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A flaw was found in the QEMU Virtio PCI Bindings, specifically in the hw/virtio/virtio-pci.c file. This issue is related to an improper release and use of the irqfd for vector 0 during the boot process, which can lead to a guest triggerable crash via the vhost net stop() function. This allows a malicious guest to crash the QEMU process on the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-672

Related Identifiers

AZL-60919

BDU:2025-14443

CVE-2024-4693

OPENSUSE-SU-2024_4094-1

SUSE-SU-2024:3744-1

SUSE-SU-2024:4094-1

SUSE-SU-2024_4094-1

SUSE-SU-2025:20076-1

USN-7094-1

Affected Products

Linuxmint

Qemu

Red Os

Suse

Ubuntu

References · 48

• https://ubuntu.com/security/CVE-2020-13765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4693 · Security Note
• https://ubuntu.com/security/CVE-2024-7730 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4693 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8608 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-4693 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7039 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3594 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-4693 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7094-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3019 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4094-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20076-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-4693 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3592 · Vendor Advisory