CVE-2024-8612
Qemu-kvm: information leak in virtio devices
概要
Qemu-kvm: information leak in virtio devices
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-8612 qemu
- Ubuntu UBUNTU-CVE-2024-8612 qemu
参照URL
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- package gitlab.com
- patch gitlab.com
- report bugzilla.redhat.com
- web access.redhat.com