redhat advanced virtualization vulnerabilities

Latest redhat advanced virtualization CVEs

Newest publication first · page 1 of 2

1. CVE-2025-8860 Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback

   Published 2026-02-18

   Low·CVSS 3.3 EPSS 0.17%

   A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback uefi_vars_write is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data fro...

2. CVE-2025-47711 Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

   Published 2025-06-09

   Medium·CVSS 6.5 EPSS 0.48%

   There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical i...

3. CVE-2025-47712 Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

   Published 2025-06-09

   Medium·CVSS 6.5 EPSS 0.53%

   A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of ser...

4. CVE-2024-7730 Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()

   Published 2024-11-14

   High·CVSS 7.8 EPSS 0.27%

   A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the...

5. CVE-2024-3447 Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()

   Published 2024-11-14

   Medium·CVSS 6.0 EPSS 0.56%

   A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both s->data_count and the size of s->fifo_buffer are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the ho...

6. CVE-2024-6519 Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability

   Published 2024-10-21

   High·CVSS 8.2 EPSS 0.25%

   A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

7. CVE-2024-8612 Qemu-kvm: information leak in virtio devices

   Published 2024-09-20

   Low·CVSS 3.8 EPSS 0.20%

   A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest....

8. CVE-2024-8354 Qemu-kvm: usb: assertion failure in usb_ep_get()

   Published 2024-09-19

   Medium·CVSS 5.5 EPSS 0.29%

   A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of serv...

9. CVE-2024-8235 Libvirt: crash of virtinterfaced via virconnectlistinterfaces()

   Published 2024-08-30

   Medium·CVSS 6.2 EPSS 0.24%

   A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash...

10. CVE-2024-7409 Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

    Published 2024-08-05

    High·CVSS 7.5 EPSS 1.0%

    A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

11. CVE-2024-7383 Libnbd: nbd server improper certificate validation

    Published 2024-08-05

    High·CVSS 7.4 EPSS 0.39%

    A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.

12. CVE-2024-6505 Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

    Published 2024-07-05

    Medium·CVSS 6.8 EPSS 0.66%

    A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap ove...

13. CVE-2024-4467 Qemu-kvm: 'qemu-img info' leads to host file read/write

    Published 2024-07-02

    High·CVSS 7.8 EPSS 0.34%

    A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of s...

14. CVE-2024-4693 Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash

    Published 2024-05-10

    Medium·CVSS 5.5 EPSS 0.33%

    A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the ho...

15. CVE-2024-4418 Libvirt: stack use-after-free in virnetclientioeventloop()

    Published 2024-05-08

    Medium·CVSS 6.2 EPSS 0.49%

    A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the data pointer to a stack-allocated virNetClientIOEventData structure ended up being used in the virNetClientIOEventFD callback while t...

16. CVE-2024-3567 Qemu-kvm: net: assertion failure in update_sctp_checksum()

    Published 2024-04-10

    Medium·CVSS 5.5 EPSS 0.45%

    A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condit...

17. CVE-2024-3446 Qemu: virtio: dma reentrancy issue leads to double free vulnerability

    Published 2024-04-09

    High·CVSS 8.2 EPSS 0.31%

    A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU proce...

18. CVE-2024-2494 Libvirt: negative g_new0 length can lead to unbounded memory allocation

    Published 2024-03-21

    Medium·CVSS 6.2 EPSS 0.37%

    A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negativ...

19. CVE-2024-2496 Libvirt: null pointer dereference in udevconnectlistallinterfaces()

    Published 2024-03-18

    Medium·CVSS 5.5 EPSS 0.25%

    A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perfo...

20. CVE-2024-1441 Libvirt: off-by-one error in udevlistinterfacesbystatus()

    Published 2024-03-11

    Medium·CVSS 5.5 EPSS 0.40%

    An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the names array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to p...

21. CVE-2023-6683 Qemu: vnc: null pointer dereference in qemu_clipboard_request()

    Published 2024-01-12

    Medium·CVSS 6.5 EPSS 1.3%

    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference....

22. CVE-2023-6693 Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()

    Published 2024-01-02

    Medium·CVSS 5.3 EPSS 0.33%

    A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious use...

23. CVE-2023-5088 Qemu: improper ide controller reset can lead to mbr overwrite

    Published 2023-11-03

    High·CVSS 7.0 EPSS 0.26%

    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of...

24. CVE-2023-5215 Libnbd: crash or misbehaviour when nbd server returns an unexpected block size

    Published 2023-09-28

    Medium·CVSS 6.5 EPSS 0.81%

    A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_g...

25. CVE-2023-2680 Dma reentrancy issue (incomplete fix for cve-2021-3750)

    Published 2023-09-13

    High·CVSS 8.2 EPSS 0.24%

    This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.