cbcvebase.
CVE-2024-8354
published 2024-09-19

CVE-2024-8354: A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

Affected

23 ranges
VendorProductVersion rangeFixed in
debianqemu< qemu 1:10.1.1+ds-1 (forky)qemu 1:10.1.1+ds-1 (forky)
msrcazl3_qemu_8.2.0-17_on_azure_linux_3.0——
msrcazl3_qemu_8.2.0-19_on_azure_linux_3.0——
msrcazl3_qemu_8.2.0-21_on_azure_linux_3.0——
msrcazl3_qemu_8.2.0-23_on_azure_linux_3.0——
msrcazl3_qemu_8.2.0-25_on_azure_linux_3.0——
msrcazl3_qemu_8.2.0-27_on_azure_linux_3.0——
msrcazl3_qemu_9.1.0-1_on_azure_linux_3.0——
msrcazl3_qemu_9.1.0-3_on_azure_linux_3.0——
msrccbl2_qemu_6.2.0-24_on_cbl_mariner_2.0——
msrccbl2_qemu_6.2.0-25_on_cbl_mariner_2.0——
msrccbl2_qemu_6.2.0-26_on_cbl_mariner_2.0——
msrccbl2_qemu_6.2.0-27_on_cbl_mariner_2.0——
qemuqemu>= 0 < 1:10.1.1+ds-11:10.1.1+ds-1
qemuqemu>= 0 < 1:6.2+dfsg-2ubuntu6.271:6.2+dfsg-2ubuntu6.27
qemuqemu>= 0 < 1:6.2+dfsg-2ubuntu6.281:6.2+dfsg-2ubuntu6.28
qemuqemu>= 0 < 1:8.2.2+ds-0ubuntu1.101:8.2.2+ds-0ubuntu1.10
qemuqemu>= 0 < 1:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.13
qemuqemu>= 0 < 1:10.1.0+ds-5ubuntu2.41:10.1.0+ds-5ubuntu2.4
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.2HIGH