CVE-2024-49863 is a vulnerability in the Linux kernel's vhost-scsi subsystem, specifically a null pointer dereference bug in the function vhost_scsi_get_req(). The issue arises from improper handling of certain SCSI AN (Asynchronous Notification) requests sent by a guest in a virtualized environment using vhost-scsi. In the vulnerable code, the pointer vc.target is assigned based on the request type. For VIRTIO_SCSI_T_AN_* requests, vc.target is explicitly set to NULL because the target portal group (tpg) is not required. However, vhost_scsi_get_req() later dereferences vc.target without checking if it is NULL, leading to a null pointer dereference. This causes the vhost_worker process to crash while holding a mutex (vq->mutex), resulting in a general protection fault and the indefinite occupation of the corresponding target portal group (tpg). The bug can be triggered remotely by a guest VM sending a crafted SCSI AN request, making it a denial-of-service (DoS) vector against the host's vhost-scsi service. The vulnerability was introduced since commit 3f8ca2e115e5 and affects Linux kernel versions including 6.10.0+ as indicated by the KASAN report. The root cause is a missing null check in vhost_scsi_get_req(), which has been addressed by adding the necessary validation. This vulnerability does not require user interaction beyond the guest VM sending the malicious request, but it does require the attacker to have guest VM access to the host's vhost-scsi interface. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to environments running Linux hosts with vhost-scsi enabled for virtualization, such as cloud providers, data centers, and enterprises using KVM/QEMU virtualization with SCSI passthrough or emulation. Exploitation can cause denial of service by crashing the vhost_worker process, potentially leading to degraded performance or unavailability of virtualized storage services. This can disrupt critical workloads relying on virtual machines, impacting business continuity. Since the bug causes indefinite occupation of target portal groups, it may also lead to resource exhaustion and complicate recovery without host intervention. Confidentiality and integrity impacts are limited as the vulnerability does not allow code execution or privilege escalation directly, but availability impact is significant. European organizations with high virtualization density or those providing Infrastructure as a Service (IaaS) are particularly at risk. Additionally, organizations relying on Linux kernel versions affected by this bug without timely patching may face operational disruptions. The lack of known exploits reduces immediate risk, but the ease of triggering the bug from guest VMs means that malicious insiders or compromised guests could leverage this vulnerability.

To mitigate CVE-2024-49863, organizations should: 1) Apply the official Linux kernel patches that add the necessary null pointer checks in vhost_scsi_get_req() as soon as they become available from trusted Linux distributions or kernel maintainers. 2) For environments where patching is delayed, consider disabling vhost-scsi or restricting guest VM capabilities to prevent sending crafted SCSI AN requests. 3) Implement strict isolation and monitoring of guest VMs to detect anomalous SCSI traffic patterns that could indicate exploitation attempts. 4) Use kernel live patching solutions if available to minimize downtime while applying fixes. 5) Regularly audit virtualization host configurations to ensure vhost-scsi is only enabled where necessary and that guest VM privileges are minimized. 6) Monitor system logs and kernel crash reports for signs of vhost_worker process crashes or mutex lockups indicative of exploitation. 7) Engage with Linux vendor security advisories and update virtualization infrastructure promptly. These steps go beyond generic advice by focusing on virtualization-specific controls and operational monitoring tailored to the vhost-scsi subsystem.