Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected | — |
| Red Hat | Red Hat Enterprise Linux 6 | affected | — |
| Red Hat | Red Hat Enterprise Linux 7 | affected | — |
| Red Hat | Red Hat Enterprise Linux 7 | affected | — |
| Red Hat | Red Hat Enterprise Linux 8 | affected | — |
| Red Hat | Red Hat Enterprise Linux 9 | affected | — |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | unknown | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | affected | — |
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Qemu | Qemu |
|
||||||||
| Redhat | Enterprise Linux |
|
||||||||
| Redhat | Enterprise Linux For Nvidia 26 |
|
||||||||
| Redhat | Openshift Container Platform |
|
Vendor Workaround
If vhost inflight migration is not required, it can be disabled by omitting the inflight parameter from the vhost-user device configuration. This prevents the vulnerable VMState deserialization path from being reached on the destination. Environments that require vhost inflight migration for live migration of vhost-user devices cannot use this mitigation and should prioritize applying the fix.
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.394% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Els
|
|
| CPEs | cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:openshift:5 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7 |
| Vendors & Products |
Redhat rhel Els
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Qemu
Qemu qemu Redhat enterprise Linux For Nvidia 26 Redhat openshift Container Platform |
|
| Vendors & Products |
Qemu
Qemu qemu Redhat enterprise Linux For Nvidia 26 Redhat openshift Container Platform |
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration. | |
| Title | Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat enterprise Linux Nvidia Redhat openshift |
|
| Weaknesses | CWE-681 | |
| CPEs | cpe:/a:redhat:enterprise_linux_nvidia: cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat enterprise Linux Nvidia Redhat openshift |
|
| References |
| |
| Metrics |
cvssV3_1
|