CVE-2024-24474
published 2024-02-20CVE-2024-24474: QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of…
PriorityP351high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.40%
69.4th percentile
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 1:7.2+dfsg-7+deb12u3 (bookworm) | qemu 1:7.2+dfsg-7+deb12u3 (bookworm) |
| msrc | cbl2_qemu_6.2.0-20_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_qemu_6.2.0-24_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| qemu | qemu | < 8.2.0 | 8.2.0 |
| qemu | qemu | >= 0 < 1:7.2+dfsg-7+deb12u3 | 1:7.2+dfsg-7+deb12u3 |
| qemu | qemu | >= 0 < 1:8.2.0+ds-1 | 1:8.2.0+ds-1 |
| qemu | qemu | >= 0 < 1:8.2.0+ds-1 | 1:8.2.0+ds-1 |
| qemu | qemu | >= 0 < 1:6.2+dfsg-2ubuntu6.22 | 1:6.2+dfsg-2ubuntu6.22 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
qemu vulnerabilities
osv·2024-08-13·CVSS 6.5
CVE-2023-6683 [MEDIUM] qemu vulnerabilities
qemu vulnerabilities
Markus Frank and Fiona Ebner discovered that QEMU did not properly
handle certain memory operations, leading to a NULL pointer dereference.
An authenticated user could potentially use this issue to cause a denial
of service. (CVE-2023-6683)
Xiao Lei discovered that QEMU did not properly handle certain memory
operations when specific features were enabled, which could lead to a
stack overflow. An attacker could potentially use this issue to leak
sensitive information. (CVE-2023-6693)
It was discovered that QEMU had an integer underflow vulnerability in
the TI command, which would result in a buffer overflow. An attacker
could potentially use this issue to cause a denial of service.
(CVE-2024-24474)
GHSA
GHSA-v4q2-79g6-j728: Buffer Overflow vulnerability in Qemu before v
ghsa_unreviewed·2024-02-20
CVE-2024-24474 [HIGH] CWE-120 GHSA-v4q2-79g6-j728: Buffer Overflow vulnerability in Qemu before v
Buffer Overflow vulnerability in Qemu before v.8.2.0 allows a remote attacker to execute arbitrary code via the async_len variable to the FIFO buffer component.
OSV
CVE-2024-24474: QEMU before 8
osv·2024-02-20·CVSS 8.8
CVE-2024-24474 [HIGH] CVE-2024-24474: QEMU before 8
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2024-08-13·CVSS 6.5
CVE-2023-6693 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Markus Frank and Fiona Ebner discovered that QEMU did not properly
handle certain memory operations, leading to a NULL pointer dereference.
An authenticated user could potentially use this issue to cause a denial
of service. (CVE-2023-6683)
Xiao Lei discovered that QEMU did not properly handle certain memory
operations when specific features were enabled, which could lead to a
stack overflow. An attacker could potentially use this issue to leak
sensitive information. (CVE-2023-6693)
It was discovered that QEMU had an integer underflow vulnerability in
the TI command, which would result in a buffer overflow. An attacker
could potentially use this issue to cause a denial of service.
(CVE-2024-24474)
Instruc
Red Hat
QEMU: esp: integer underflow leads to heap buffer overflow in esp_do_nodma()
vendor_redhat·2024-02-20·CVSS 8.8
CVE-2024-24474 [HIGH] CWE-191 QEMU: esp: integer underflow leads to heap buffer overflow in esp_do_nodma()
QEMU: esp: integer underflow leads to heap buffer overflow in esp_do_nodma()
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
A flaw was found in the am53c974 SCSI controller emulation of QEMU. When an SCSI layer transfer is incorrectly terminated, it is possible for a TI command to cause an SCSI buffer overflow due to the expected transfer data length being less than the available data in the FIFO. When this occurs, the unsigned async_len variable underflows and becomes a large offset, which writes past the end of the allocated SCSI buffer. This flaw could allow a malicio
Microsoft
QEMU before 8.2.0 has an integer underflow and resultant buffer overflow via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in es
vendor_msrc·2024-02-13·CVSS 8.8
CVE-2024-24474 [HIGH] CWE-120 QEMU before 8.2.0 has an integer underflow and resultant buffer overflow via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in es
QEMU before 8.2.0 has an integer underflow and resultant buffer overflow via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. I
Debian
CVE-2024-24474: qemu - QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a...
vendor_debian·2024·CVSS 8.8
CVE-2024-24474 [HIGH] CVE-2024-24474: qemu - QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a...
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Scope: local
bookworm: resolved (fixed in 1:7.2+dfsg-7+deb12u3)
bullseye: resolved
forky: resolved (fixed in 1:8.2.0+ds-1)
sid: resolved (fixed in 1:8.2.0+ds-1)
trixie: resolved (fixed in 1:8.2.0+ds-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615ehttps://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52https://gitlab.com/qemu-project/qemu/-/issues/1810https://security.netapp.com/advisory/ntap-20240510-0012/https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615ehttps://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52https://gitlab.com/qemu-project/qemu/-/issues/1810https://security.netapp.com/advisory/ntap-20240510-0012/
2024-02-20
Published