Moderate Vulnerability in qemu-kvm: Stack Buffer Overflow and Assertion Failure
Summary
RLSA-2025:4492: Moderate: qemu-kvm security update. Affects qemu-kvm versions < 7:9.0.0-10.el9_5.3. Fixed in 7:9.0.0-10.el9_5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux that enables users to run multiple virtual machines on various architectures. The qemu-kvm package provides the necessary user-space components to manage and run these virtual machines. It is widely used in cloud computing and virtualization environments, making its security critical for maintaining system integrity and performance.
Vulnerability Detail
The qemu-kvm package has been identified with two significant vulnerabilities. The first, CVE-2023-6693, involves a stack buffer overflow in the virtio_net_flush_tx() function, which can lead to potential arbitrary code execution. The second, CVE-2024-3567, is an assertion failure in the update_sctp_checksum() function, which could result in denial of service. Both vulnerabilities can severely impact the stability and security of virtual machines running on affected systems.
How To Fix
Minimum fixed version
7:9.0.0-10.el9_5.3
This is the first release that contains the fix.
sudo dnf update qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their virtual machines by restricting network access or disabling specific features that utilize the affected functions until the package is updated.
Conclusion
The vulnerabilities identified in the qemu-kvm package pose significant risks to virtual machine security and stability. It is crucial for users to update to the patched version promptly and consider workarounds if immediate updates cannot be applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for qemu-kvm →
FAQ
The CVSS score for the vulnerabilities in qemu-kvm is 5.5, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities could lead to arbitrary code execution or denial of service, compromising the security and stability of virtual machines.
Yes, you should upgrade to version 7:9.0.0-10.el9_5.3 to mitigate the vulnerabilities.
If immediate updates are not possible, consider implementing network restrictions or disabling affected features as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
