CVE-2024-6519

What it actually does

Use-after-free condition in QEMU LSI53C895A SCSI Host Bus Adapter emulation that can result in guest-to-host memory corruption, process crash, or virtual machine escape.

Why it matters to the business

Virtualized workloads on affected hosts face elevated risk of denial of service or full host compromise; low EPSS and lack of KEV listing indicate limited active exploitation but still require prompt patching on Rocky Linux 8 systems running the listed rsync package.

How an attack unfolds

An attacker with control of a guest VM sends specially crafted SCSI commands to the emulated LSI53C895A controller, triggering the use-after-free to corrupt hypervisor memory structures and ultimately escape the VM boundary.

How to fix it

Upgrade the affected rsync package on Rocky Linux 8 to version 0:3.1.3-14.el8_6.2 or later; apply the update through the system package manager and restart any QEMU processes using the emulated device.

How to confirm the fix worked

Verify the installed package version matches or exceeds the fixed release, confirm QEMU instances load the updated emulation code, and test that the LSI53C895A device no longer exhibits the crash or escape behavior under synthetic SCSI workloads.

Typical attack path

1. Obtain code execution inside a guest virtual machine
2. Issue malicious SCSI requests targeting the LSI53C895A emulation layer
3. Trigger the use-after-free to achieve memory corruption
4. Leverage corruption to escape the hypervisor and execute code on the host

How to detect it

Review hypervisor logs and QEMU process traces for unexpected crashes or segmentation faults involving the LSI53C895A device; look for anomalous SCSI command patterns originating from guest VMs.

What your security team should do

• Prioritize patching Rocky Linux 8 hosts running QEMU with LSI53C895A emulation within the next maintenance window
• Inventory all virtual machines using SCSI HBA emulation and isolate high-value workloads until updated
• Monitor EPSS and KEV feeds for any future increase in exploit maturity