Threats Tagged 'cve-2024-7409'

This Red Hat security advisory addresses multiple vulnerabilities in the virt:rhel and virt-devel:rhel modules used for Kernel-based Virtual Machine (KVM) virtualization on Red Hat Enterprise Linux 8. The issues include a double free vulnerability in QEMU's virtio DMA handling (CVE-2024-3446), a denial of service caused by improper synchronization in the QEMU NBD server during socket closure (CVE-2024-7409), and improper certificate validation in the libnbd NBD server (CVE-2024-7383). These vulnerabilities have been rated with moderate severity by Red Hat. Updates are available to remediate these issues for various Red Hat Enterprise Linux 8 architectures and related modules. No known exploits in the wild have been reported at this time.

Red Hat has issued a moderate severity security advisory for qemu-kvm in Red Hat Enterprise Linux 9. The update addresses three vulnerabilities: a buffer overflow due to improper validation of NumVFs in SR-IOV (CVE-2024-26327), a double free vulnerability from a DMA reentrancy issue in virtio (CVE-2024-3446), and a denial of service caused by improper synchronization in the QEMU NBD server during socket closure (CVE-2024-7409). These vulnerabilities affect the user-space component of KVM virtualization. The advisory includes patches for these issues in Red Hat Enterprise Linux 9 and its extended update and life cycle support variants.

A denial of service vulnerability (CVE-2024-7409) exists in the QEMU NBD server component used by qemu-kvm, caused by improper synchronization during socket closure. This affects the user-space component of Kernel-based Virtual Machine (KVM) virtualization on Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat has issued a security advisory with an update to address this issue.