CVE-2024-6505Medium· 6.8▾ SunlitA flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-boun…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.
qemu >= 5.1.0 < 9.1.0qemu-kvm (all versions)qemu-kvmqemu-kvmqemu-kvm-mavirt:rhel/qemu-kvm (all versions)virt:av/qemu-kvm (all versions)qemu-kvm (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
A viable mitigation for this vulnerability is to disable RSS on the nic/virtio driver. This can be performed either with the following qemu-kvm command "-device virtio-net-pci,rss=off", or, alternatively, by directly modifying the KVM XML file to disable RSS using a standard configuration tool (ex. libvirt).
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-2243Medium· 5.1A flaw was found in QEMU
CVE-2024-8354Medium· 5.5Qemu-kvm: usb: assertion failure in usb_ep_get()
CVE-2024-8612Low· 3.8Qemu-kvm: information leak in virtio devices
CVE-2024-4693Medium· 5.5Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
CVE-2022-2127Medium· 5.9Samba: out-of-bounds read in winbind auth_crap
CVE-2026-120830High· 7.4Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure