Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-3446
HistoryApr 09, 2024 - 12:00 a.m.

CVE-2024-3446

2024-04-0900:00:00
ubuntu.com
ubuntu.com
10
cve-2024-3446
qemu
virtio devices
dma reentrancy
denial of service
arbitrary code execution
unix

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

A double free vulnerability was found in QEMU virtio devices (virtio-gpu,
virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag
insufficiently protects against DMA reentrancy issues. This issue could
allow a malicious privileged guest user to crash the QEMU process on the
host, resulting in a denial of service or allow arbitrary code execution
within the context of the QEMU process on the host.

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%