CVE-2024-24474 — Classic Buffer Overflow in Qemu

CWE-120 — Classic Buffer OverflowCWE-191 — Integer Underflow (Wrap or Wraparound)9 documents8 sources
Severity
8.8HIGHNVD
OSV6.5
EPSS
0.6%
top 30.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Qemu
Timeline
PublishedFeb 20
Latest updateAug 13

Description

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDqemu/qemu< 8.2.0
▶Debianqemu/qemu< 1:7.2+dfsg-7+deb12u3+2
▶Ubuntuqemu/qemu< 1:6.2+dfsg-2ubuntu6.22

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
qemu vulnerabilities↗2024-08-13
▶
GHSA
GHSA-v4q2-79g6-j728: Buffer Overflow vulnerability in Qemu before v↗2024-02-20
▶
OSV
CVE-2024-24474: QEMU before 8↗2024-02-20
▶
CVEList
CVE-2024-24474: QEMU before 8↗2024-02-20
▶

📋Vendor Advisories

4
Ubuntu
QEMU vulnerabilities↗2024-08-13
▶
Red Hat
QEMU: esp: integer underflow leads to heap buffer overflow in esp_do_nodma()↗2024-02-20
▶
Microsoft
QEMU before 8.2.0 has an integer underflow and resultant buffer overflow via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in es↗2024-02-13
▶
Debian
CVE-2024-24474: qemu - QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a...↗2024
▶