CVE-2024-6505

What it actually does

Out-of-bounds index access on the controllable indirections_table during RSS configuration in virtio-net leads to heap overflow and guest-triggered QEMU process termination on the host.

Why it matters to the business

A compromised or malicious guest VM can force the hypervisor to crash, causing denial of service for all hosted virtual machines and interrupting operations on affected hosts.

How an attack unfolds

An attacker with administrative access inside a guest VM enables the RSS feature on the virtio-net device and supplies oversized values to the indirections_table, triggering an index out-of-bounds write that overflows the heap and terminates the QEMU process.

How to fix it

Upgrade QEMU to a version containing the virtio-net RSS bounds check fix; if immediate patching is unavailable, disable RSS on virtio-net devices via device configuration or migration to alternative network backends.

How to confirm the fix worked

Confirm QEMU version is newer than the vulnerable release, review virtio-net device XML or command-line flags for RSS settings, and attempt RSS configuration with boundary values in a test environment to verify crash prevention.

Typical attack path

1. Obtain privileged access inside a guest VM
2. Configure virtio-net device with RSS enabled
3. Supply excessively large values to the indirections_table
4. Trigger the out-of-bounds heap access to crash QEMU on the host

How to detect it

Review QEMU process logs, system crash dumps, and hypervisor audit records for abrupt termination events coinciding with guest RSS configuration changes; correlate guest VM administrative logins with subsequent host QEMU restarts.

• QEMU segmentation fault or abort in virtio-net RSS code paths
• Unexpected host process termination of qemu-system-* binaries
• Guest virtio-net device configuration changes logged immediately before host crash

What your security team should do

• Prioritize patching QEMU on all hosts running virtio-net with RSS enabled
• Audit guest VM configurations for RSS usage and restrict privileged guest access
• Monitor for QEMU process restarts or crashes as an interim detection measure
• Consider network device alternatives that do not expose the vulnerable RSS path until updates are applied