CVE-2024-6519
📋 TL;DR
A use-after-free vulnerability in QEMU's LSI53C895A SCSI Host Bus Adapter emulation allows attackers to cause a denial of service or potentially escape the virtual machine. This affects any system running QEMU with SCSI emulation enabled. Virtualization hosts and cloud providers using QEMU/KVM are particularly at risk.
💻 Affected Systems
- QEMU
- Red Hat Enterprise Linux
- Fedora
- CentOS Stream
- Ubuntu
- Debian
- SUSE Linux Enterprise Server
📦 What is this software?
Qemu by Qemu
⚠️ Risk & Real-World Impact
Worst Case
Full VM escape allowing attacker to compromise the host system and other VMs on the same hypervisor.
Likely Case
QEMU process crash leading to denial of service for the affected virtual machine.
If Mitigated
Limited to denial of service if proper isolation and security controls are implemented.
🎯 Exploit Status
Exploitation requires access to the guest VM and ability to send crafted SCSI commands. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: QEMU 9.1.0 and later
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-6519
Restart Required: Yes
Instructions:
1. Update QEMU to version 9.1.0 or later. 2. For Red Hat systems: 'yum update qemu-kvm'. 3. For Ubuntu/Debian: 'apt update && apt upgrade qemu-system'. 4. Restart all affected virtual machines.
🔧 Temporary Workarounds
Disable LSI53C895A SCSI controller
linuxSwitch from LSI53C895A to virtio-scsi controller for affected VMs
virsh edit <vm_name>
Change controller type='scsi' model='lsi53c895a' to model='virtio-scsi'
Isolate VM networks
allRestrict network access to vulnerable VMs to prevent lateral movement
🧯 If You Can't Patch
- Migrate affected VMs to virtio-scsi controller instead of LSI53C895A
- Isolate vulnerable VMs on separate network segments with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check QEMU version with 'qemu-system-x86_64 --version' and verify if below 9.1.0. Check VM configuration for LSI53C895A SCSI controller.Check Version:
qemu-system-x86_64 --version | head -1Verify Fix Applied:
Confirm QEMU version is 9.1.0 or later with 'qemu-system-x86_64 --version'. Verify VM configuration no longer uses LSI53C895A controller.📡 Detection & Monitoring
Log Indicators:
- QEMU process crashes in host logs
- Unexpected SCSI command errors in guest logs
- VM restart events without clear cause
Network Indicators:
- Unusual SCSI command patterns from guest VMs
- Sudden loss of connectivity to VM
SIEM Query:
source="qemu.log" AND ("crash" OR "segfault" OR "use-after-free")