CVE-2024-3567 — Reachable Assertion in Qemu

CWE-617 — Reachable Assertion9 documents9 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 75.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
QemuRedhat Enterprise Linux
Timeline
PublishedApr 10
Latest updateSep 11

Description

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDqemu/qemu8.1.0 — 8.2.3+1
▶Debianqemu/qemu< 1:8.2.3+ds-1+1

Also affects: Enterprise Linux 9.0

🔴Vulnerability Details

3
GHSA
GHSA-mqq7-33jf-2x53: A flaw was found in QEMU↗2024-04-10
▶
OSV
CVE-2024-3567: A flaw was found in QEMU↗2024-04-10
▶
CVEList
Qemu-kvm: net: assertion failure in update_sctp_checksum()↗2024-04-10
▶

📋Vendor Advisories

4
Ubuntu
QEMU vulnerabilities↗2025-09-11
▶
Microsoft
Qemu-kvm: net: assertion failure in update_sctp_checksum()↗2024-04-09
▶
Red Hat
qemu-kvm: net: assertion failure in update_sctp_checksum()↗2024-04-08
▶
Debian
CVE-2024-3567: qemu - A flaw was found in QEMU. An assertion failure was present in the update_sctp_ch...↗2024
▶

💬Community

1
Bugzilla
CVE-2023-3567 kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race↗2023-07-09
▶