{"id":"CVE-2024-24474","aliases":["AZL-47784","BELL-CVE-2024-24474","DEBIAN-CVE-2024-24474","EUVD-2024-21893","GHSA-v4q2-79g6-j728","MGASA-2024-0387","OESA-2024-1420","OESA-2024-1421","OESA-2024-1422","OESA-2024-1491","SUSE-SU-2024:1103-1","SUSE-SU-2024:1394-1","UBUNTU-CVE-2024-24474","USN-6954-1"],"status":"published","title":"Buffer Overflow vulnerability in Qemu before v.8.2.0 allows a remote attacker to execute...","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01397,"percentile":0.72621,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-191"],"published":"2024-02-20T00:00:00Z","modified":"2026-11-02T12:00:50Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-20"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"qemu","fixed_in":["9.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["8.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.2.0+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.2.0+ds-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","fixed_in":["6.2.0-90.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"qemu","fixed_in":["6.2.0-90.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","fixed_in":["6.2.0-90.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.22"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-20"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"},{"fixed":"9.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"8.2.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u3"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.0+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.0+ds-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-90.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-90.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-90.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-88.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.22"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.22"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21"],"bundled":3}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://gitlab.com/qemu-project/qemu/-/issues/1810","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52","tags":["x_transferred","Patch","fix"]},{"url":"https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0012/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24474","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0012"},{"url":"https://github.com/advisories/GHSA-v4q2-79g6-j728"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-24474","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-55","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24474.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-24474","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1420","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1421","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1422","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3447","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241103-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205316","tags":["report"]},{"url":"https://bugzilla.suse.com/1209554","tags":["report"]},{"url":"https://bugzilla.suse.com/1218484","tags":["report"]},{"url":"https://bugzilla.suse.com/1220062","tags":["report"]},{"url":"https://bugzilla.suse.com/1220065","tags":["report"]},{"url":"https://bugzilla.suse.com/1220134","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26328","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213269","tags":["report"]},{"url":"https://bugzilla.suse.com/1218889","tags":["report"]},{"url":"https://bugzilla.suse.com/1222843","tags":["report"]},{"url":"https://bugzilla.suse.com/1222845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3447","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-24474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24474","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6954-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6693","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-24474","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T00:00:00Z","modified":"2024-08-15T20:20:15.4Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-191","CWE-120"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-21893","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T00:00:00Z","modified":"2024-08-15T20:20:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:16.665209Z"}],"ghsa":[{"id":"GHSA-v4q2-79g6-j728","title":"Buffer Overflow vulnerability in Qemu before v.8.2.0 allows a remote attacker to execute...","description":"Buffer Overflow vulnerability in Qemu before v.8.2.0 allows a remote attacker to execute arbitrary code via the async_len variable to the FIFO buffer component.","status":"published","published":"2024-02-20T18:30:35Z","modified":"2024-08-16T00:32:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:57:59.133266Z"}],"nvd":[{"id":"CVE-2024-24474","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T18:15:52.463Z","modified":"2026-06-17T07:14:31.17Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-120","CWE-191"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"BELL-CVE-2024-24474","status":"published","published":"2024-02-21T05:58:53.547428Z","modified":"2026-01-26T09:42:51.505098Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-24474","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T00:00:00Z","modified":"2026-10-28T10:40:20.151551947Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-24474","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T18:15:52.463Z","modified":"2026-11-02T12:00:50.201572629Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1420","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nQEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.(CVE-2024-24474)","status":"published","published":"2024-04-12T11:06:52Z","modified":"2026-08-18T01:18:20.937803662Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1421","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nQEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.(CVE-2024-24474)","status":"published","published":"2024-04-12T11:06:52Z","modified":"2026-08-18T01:18:20.765439618Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1422","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nQEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.(CVE-2024-24474)","status":"published","published":"2024-04-12T11:06:52Z","modified":"2026-08-18T01:18:20.739530017Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1491","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nQEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.(CVE-2024-24474)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:56Z","modified":"2026-08-18T01:18:24.432777681Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-24474","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T18:15:00Z","modified":"2026-02-04T03:30:07.088457Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"AZL-47784","title":"CVE-2024-24474 affecting package qemu for versions less than 6.2.0-20","description":"QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.","status":"published","published":"2024-02-20T18:15:52Z","modified":"2026-04-21T04:31:40.114299Z","updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:1103-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-26327: Fixed buffer overflow via invalid SR/IOV NumVFs value (bsc#1220062).\n- CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134).\n- CVE-2023-6693: Fixed stack buffer overflow in virtio_net_flush_tx() (bsc#1218484).\n- CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554).\n- CVE-2024-26328: Fixed invalid NumVFs value handled in NVME SR/IOV implementation (bsc#1220065).\n\nThe following non-security bug was fixed:\n\n- Removing in-use mediated device should fail with error message instead of hang (bsc#1205316).\n","status":"published","published":"2024-04-03T12:11:07Z","modified":"2026-02-04T04:40:44.89986Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1394-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n - CVE-2023-3019: Fixed heap use-after-free in e1000e_write_packet_to_guest() (bsc#1213269)\n - CVE-2023-6683: Fixed NULL pointer dereference in qemu_clipboard_request() (bsc#1218889)\n - CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134)\n - CVE-2024-3446: Fixed DM reentrancy issue that could lead to double free vulnerability (bsc#1222843)\n - CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845)\n","status":"published","published":"2024-04-23T09:16:10Z","modified":"2026-02-04T02:37:37.275335Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6954-1","title":"qemu vulnerabilities","description":"Markus Frank and Fiona Ebner discovered that QEMU did not properly\nhandle certain memory operations, leading to a NULL pointer dereference.\nAn authenticated user could potentially use this issue to cause a denial\nof service. (CVE-2023-6683)\n\nXiao Lei discovered that QEMU did not properly handle certain memory \noperations when specific features were enabled, which could lead to a\nstack overflow. An attacker could potentially use this issue to leak\nsensitive information. (CVE-2023-6693)\n\nIt was discovered that QEMU had an integer underflow vulnerability in \nthe TI command, which would result in a buffer overflow. An attacker\ncould potentially use this issue to cause a denial of service. \n(CVE-2024-24474)\n","status":"published","published":"2024-08-13T06:44:37Z","modified":"2026-02-10T04:45:02Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}