A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueuepush as set in virtioscsicompletereq / virtioblkreqcomplete / viritocryptoreqcomplete could be larger than the true size of the data which has been sent to guest. Once virtqueuepush() finally calls dmamemoryunmap to ummap the iniov, it may call the addressspacewrite function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.
{ "vanir_signatures": [ { "id": "CVE-2024-8612-0db0fb30", "digest": { "length": 531.0, "function_hash": "132930612537335779920509481660983398955" }, "target": { "function": "address_space_init", "file": "system/memory.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-119b6fc6", "digest": { "length": 3081.0, "function_hash": "320345154935702516298476972324358587699" }, "target": { "function": "do_pci_register_device", "file": "hw/pci/pci.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-429a0938", "digest": { "length": 234.0, "function_hash": "90132379395775269302738469515014332753" }, "target": { "function": "pci_device_class_init", "file": "hw/pci/pci.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-5b104ca1", "digest": { "line_hashes": [ "9247625198448316988026293439513667069", "34355294354539034258534246361076733963", "269259404107293633229143974564984626665", "112281185139124980173536780051362086867", "118416135963800301147568460821856196267", "261676435263660979780647118193871361706", "74409668556452770348014777606008771007", "111550840252874566376204103575836112849", "270894510902669733492531670996929672297", "92091661918861599484832527522568904640", "179811354238332953369322707277117273863", "150791625311113059266033168368281747786", "221237929465038685513794967038902424951", "254699281943358603113005003423008803400" ], "threshold": 0.9 }, "target": { "file": "include/exec/memory.h" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Line" }, { "id": "CVE-2024-8612-71378201", "digest": { "line_hashes": [ "141825883516723248210674029385510518521", "220172297416463810511389149138719816477", "253847633574127986466840348962194187587", "82571666185059959064006208942608644524", "160056858984875153372921408573944415868", "331186706496620825781216683163275914390", "259127814780485747343071133488836501779", "312686064199382546430558232093797160109", "51242548077162385187768593948946631967", "285969852584277125162423857002746351736", "182766543763088569387316739487624139745", "75663345385728304372014842006173369137" ], "threshold": 0.9 }, "target": { "file": "hw/pci/pci.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Line" }, { "id": "CVE-2024-8612-8842e288", "digest": { "line_hashes": [ "212030065921287719902263664839868799567", "307579687214904363735967596015637720273", "206553969186879074444317740530121531668", "250342487488875541605468948805837122128" ], "threshold": 0.9 }, "target": { "file": "include/hw/pci/pci_device.h" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Line" }, { "id": "CVE-2024-8612-95551ed8", "digest": { "length": 651.0, "function_hash": "68709079643065923884344711921947273186" }, "target": { "function": "address_space_unmap", "file": "system/physmem.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-98dddf53", "digest": { "length": 380.0, "function_hash": "234230482525813921501351488666082312312" }, "target": { "function": "do_address_space_destroy", "file": "system/memory.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-a238b53d", "digest": { "length": 1085.0, "function_hash": "12576596688593351917133816058154942163" }, "target": { "function": "address_space_map", "file": "system/physmem.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-d1796dcf", "digest": { "length": 312.0, "function_hash": "47867800303015213411039157274273894973" }, "target": { "function": "address_space_register_map_client", "file": "system/physmem.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Function" }, { "id": "CVE-2024-8612-d22874e7", "digest": { "line_hashes": [ "298894465517429150866321704508426735647", "21154882694414907478638125279634488323", "102842955437939774919743584591160289653", "141258383194840138565343053354132474747", "215680991620797655650374104009206417743", "63742450741445510622406100308921073230", "301895137409781346728138017252172216294", "95189379972826440610452603078708999212", "156964213064039327338301715997764562050", "99987633925990798692377646094794217945", "103975001403268657243789977940996603411", "9924770301314948633235884199202408988", "260381415762079245741897431451880601681", "50092451512305357379270290948353737023", "241848321176629765256317312561791754399", "318489625226541336255906207663626924956", "81394698093417742273669304011750520767", "139242118942634174309365145019303088202", "30839666397351539774433561603058040300", "100279322493261987938740865955000124652", "272323005910040705928817098456175258249", "48109396530119630227691708761584515236", "116367093136805225223875536582907525491", "321311610861558722626561043544990984006", "34823661942407832399875029457342921617", "304677248384851600347160128054438420443", "35867084733359447407001751889385940264", "264729861947548417191339109249891445962", "101988713296757606739906580763603441631", "235874405939514805536675323401316591372", "233729251347534748566956876900577159936", "178756277341809811329516328531728142788", "103902905878820799141106754075283468346", "37460146646498924500832138270932076760", "107551605417117423859040733537986421665", "159533587609054828442460515778315548366", "329964193503594276884539371665286511253", "96683428949817994674902550443741344688", "239761995920870992490980415050177261870", "233581557902868949923354931258608249217", "326256506154850707226606322258762780659", "307272735507202142488180191245030076188", "296497809946532098467051475710625605365", "295333416675705764836621308586421975705", "9655958618658473962397410670278683548", "25872548868930899479367040984134239827", "139517967155330120284836435034799829502", "302333635482497358100682498248180202237" ], "threshold": 0.9 }, "target": { "file": "system/physmem.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Line" }, { "id": "CVE-2024-8612-fb0ea558", "digest": { "line_hashes": [ "17559866560389524278308262295873208191", "263160772200877472610679543581422586246", "208028084269664552147725214183850395517", "100011103878814517643735406897278175829", "219768647389734577510320317337679597260", "16494610825782906147817529312963542354", "88799698088586633610654413278450790181", "127410071986542291848916480186137483297" ], "threshold": 0.9 }, "target": { "file": "system/memory.c" }, "signature_version": "v1", "source": "https://gitlab.com/qemu-project/qemu@637b0aa139565cb82a7b9269e62214f87082635c", "deprecated": false, "signature_type": "Line" } ] }