CVE-2024-4693

What it actually does

Use-after-free in QEMU Virtio PCI bindings where irqfd for vector 0 is improperly released then reused during boot, allowing a guest to trigger a crash in the host QEMU process via vhost_net_stop.

Why it matters to the business

A malicious or compromised virtual machine can crash the emulator process on the host system, causing denial of service that halts all virtual machines on that host and disrupts hosted workloads until the process is restarted.

How an attack unfolds

An attacker controlling a guest VM triggers the flawed irqfd handling path during the boot sequence by invoking vhost_net_stop, leading the host QEMU process to access already-freed memory and terminate.

How to fix it

Upgrade QEMU to a release containing the corrected irqfd handling logic in hw/virtio/virtio-pci.c. Apply vendor or distribution patches as soon as they become available.

How to confirm the fix worked

Confirm the installed QEMU version includes the fix, review source changes around irqfd release for vector 0, and test that guest-initiated vhost_net_stop sequences no longer cause host process termination.

Typical attack path

1. Obtain control of a guest virtual machine
2. Initiate the boot sequence or vhost_net_stop operation
3. Trigger the use-after-free condition in virtio-pci
4. Crash the host QEMU process

How to detect it

Monitor system and application logs for abrupt QEMU process terminations, especially those occurring shortly after guest boot events or vhost_net activity; correlate with guest VM lifecycle logs.

What your security team should do

• Prioritize QEMU updates on all hosts running affected versions
• Restrict untrusted or high-risk workloads to dedicated hosts
• Enable process monitoring and automatic restart for QEMU instances
• Review hypervisor hardening options such as guest isolation features