CVE-2024-8612

What it actually does

The flaw allows uninitialized data from the bounce buffer to be written to guest memory during virtqueue_push operations in virtio-scsi, virtio-blk, and virtio-crypto devices, resulting in information disclosure from the host to the guest.

Why it matters to the business

Attackers with access to a virtual machine may obtain sensitive information from the host system, potentially exposing confidential data across isolation boundaries in widely deployed virtualization environments.

How an attack unfolds

An attacker controlling a guest VM sends crafted requests to virtio devices, triggering the completion paths that use an oversized size in virtqueue_push, causing dma_memory_unmap to write back uninitialized data from the bounce buffer to guest memory.

How to fix it

Update QEMU to the fixed commit 637b0aa139565cb82a7b9269e62214f87082635c or later version.

How to confirm the fix worked

Verify the QEMU version or commit hash includes the fix in virtio_scsi_complete_req, virtio_blk_req_complete, and virito_crypto_req_complete functions.

Typical attack path

1. Gain access to a guest VM
2. Craft and send malicious virtio requests to trigger completion handlers
3. Read the leaked data from guest memory

How to detect it

Monitor guest memory accesses or unusual data patterns post-virtio operations, but detection is challenging as no specific logs are generated.

What your security team should do

• Prioritize patching QEMU installations to the fixed version
• Monitor for updates in virtualization environments
• Limit guest access to sensitive host resources where possible