Cyber Resilience

CVE-2024-6505

Memory Safety in Redhat Enterprise Linux 8.0 … 9.0

Published
05 July 2024
Modified
21 November 2024
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0065 48th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2024-6505 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 6.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in…

more

heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The vulnerability enables a privileged guest user to trigger a heap overflow in QEMU's virtio-net RSS feature, crashing the host QEMU process and causing endpoint denial of service through application exploitation.

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0048: External Harms

CVEs Like This One

CVE-2024-3567Same product: Qemu Qemu
CVE-2023-3019Same product: Qemu Qemu
CVE-2023-2680Same product: Qemu Qemu
CVE-2023-6683Same product: Qemu Qemu
CVE-2023-5088Same product: Qemu Qemu
CVE-2023-3301Same product: Qemu Qemu
CVE-2024-8354Same product: Qemu Qemu
CVE-2026-58011Same product: Redhat Enterprise Linux
CVE-2023-6610Same product: Redhat Enterprise Linux
CVE-2023-6121Same product: Redhat Enterprise Linux

Affected Assets

qemu
qemu
all versions
redhat
enterprise linux
8.0, 9.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

prevents

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

prevents

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.

prevents

Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.

References