{"id":"CVE-2024-3447","aliases":["AZL-60196","AZL-60901","DEBIAN-CVE-2024-3447","DLA-4144-1","EUVD-2024-32034","GHSA-mq5w-grf9-5rp9","MGASA-2024-0387","OESA-2024-1491","OESA-2024-1494","OESA-2024-1505","OESA-2024-1510","OESA-2024-1511","OESA-2024-1516","SUSE-SU-2024:1394-1","SUSE-SU-2024:1438-1","SUSE-SU-2024:1438-2","SUSE-SU-2024:3229-1","SUSE-SU-2025:0692-1","SUSE-SU-2025:20011-1","UBUNTU-CVE-2024-3447","USN-7744-1","openSUSE-SU-2024:13876-1"],"status":"published","title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00557,"percentile":0.4669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2024-04-23T09:16:10Z","modified":"2026-11-02T12:02:31Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-24"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-16"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.47+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","fixed_in":["1:2.5+dfsg-5ubuntu10.51+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qemu","fixed_in":["1:2.11+dfsg-1ubuntu7.42+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qemu","fixed_in":["1:4.2-3ubuntu6.30+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-24"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u6"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1","1:7.2+dfsg-7+deb12u3","1:7.2+dfsg-7+deb12u4","1:7.2+dfsg-7+deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-11+deb11u4"}]}],"versions":["1:5.2+dfsg-11","1:5.2+dfsg-11+deb11u1","1:5.2+dfsg-11+deb11u2","1:5.2+dfsg-11+deb11u3"],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-88.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-83.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-79.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-91.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-91.oe2203sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-91.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.5-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.47+esm6"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46","2.0.0+dfsg-2ubuntu1.47","2.0.0+dfsg-2ubuntu1.47+esm1","2.0.0+dfsg-2ubuntu1.47+esm2","2.0.0+dfsg-2ubuntu1.47+esm3","2.0.0+dfsg-2ubuntu1.47+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.51+esm4"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41","1:2.5+dfsg-5ubuntu10.42","1:2.5+dfsg-5ubuntu10.43","1:2.5+dfsg-5ubuntu10.44","1:2.5+dfsg-5ubuntu10.45","1:2.5+dfsg-5ubuntu10.46","1:2.5+dfsg-5ubuntu10.47","1:2.5+dfsg-5ubuntu10.48","1:2.5+dfsg-5ubuntu10.49","1:2.5+dfsg-5ubuntu10.51","1:2.5+dfsg-5ubuntu10.51+esm1","1:2.5+dfsg-5ubuntu10.51+esm2","1:2.5+dfsg-5ubuntu10.51+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.42+esm5"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38","1:2.11+dfsg-1ubuntu7.39","1:2.11+dfsg-1ubuntu7.40","1:2.11+dfsg-1ubuntu7.41","1:2.11+dfsg-1ubuntu7.42","1:2.11+dfsg-1ubuntu7.42+esm1","1:2.11+dfsg-1ubuntu7.42+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.30+esm1"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26","1:4.2-3ubuntu6.27","1:4.2-3ubuntu6.28","1:4.2-3ubuntu6.29","1:4.2-3ubuntu6.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.27"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.10"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.27"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.10"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-2.1"}]}],"bundled":4}],"products":[{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"qemu","product":"qemu"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8 advanced virtualization"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"siemens","product":"ruggedcom rox mx5000"},{"vendor":"siemens","product":"ruggedcom rox mx5000re"},{"vendor":"siemens","product":"ruggedcom rox rx1400"},{"vendor":"siemens","product":"ruggedcom rox rx1500"},{"vendor":"siemens","product":"ruggedcom rox rx1501"},{"vendor":"siemens","product":"ruggedcom rox rx1510"},{"vendor":"siemens","product":"ruggedcom rox rx1511"},{"vendor":"siemens","product":"ruggedcom rox rx1512"},{"vendor":"siemens","product":"ruggedcom rox rx1524"},{"vendor":"siemens","product":"ruggedcom rox rx1536"},{"vendor":"siemens","product":"ruggedcom rox rx5000"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-3447","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813","tags":["Exploit","Issue Tracking","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274123","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/","tags":["Broken Link","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250425-0005/","tags":["Vendor Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-577017.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3447","tags":["web","advisory"]},{"url":"https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org"},{"url":"https://security.netapp.com/advisory/ntap-20250425-0005"},{"url":"https://github.com/advisories/GHSA-mq5w-grf9-5rp9"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3447.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3447","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0330","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3446","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1494","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1505","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1510","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1511","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1516","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213269","tags":["report"]},{"url":"https://bugzilla.suse.com/1218889","tags":["report"]},{"url":"https://bugzilla.suse.com/1220134","tags":["report"]},{"url":"https://bugzilla.suse.com/1222843","tags":["report"]},{"url":"https://bugzilla.suse.com/1222845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3447","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241438-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241438-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243229-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218484","tags":["report"]},{"url":"https://bugzilla.suse.com/1223955","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6693","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250692-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219722","tags":["report"]},{"url":"https://bugzilla.suse.com/1219733","tags":["report"]},{"url":"https://bugzilla.suse.com/1229007","tags":["report"]},{"url":"https://bugzilla.suse.com/1230915","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8612","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084909","tags":["report"]},{"url":"https://bugzilla.suse.com/1220065","tags":["report"]},{"url":"https://bugzilla.suse.com/1220310","tags":["report"]},{"url":"https://bugzilla.suse.com/1222218","tags":["report"]},{"url":"https://bugzilla.suse.com/1222841","tags":["report"]},{"url":"https://bugzilla.suse.com/1224179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3567","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-3447","tags":["report"]},{"url":"https://patchew.org/QEMU/20240409145524.27913-1-philmd@linaro.org/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3447","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7744-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8412-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-7409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8354","tags":["report"]},{"url":"https://bugs.launchpad.net/bugs/2120814","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-3447","title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:10:36.88Z","modified":"2026-05-12T11:30:37.13Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-32034","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:10:36Z","modified":"2026-05-12T11:30:37Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:04:38.188393Z"}],"ghsa":[{"id":"GHSA-mq5w-grf9-5rp9","title":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is...","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:31:02Z","modified":"2026-05-12T12:32:12Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:08:01.880471Z"}],"nvd":[{"id":"CVE-2024-3447","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:15:17.743Z","modified":"2026-06-17T07:44:17.62Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:10:37.281254Z"}],"osv":[{"id":"CVE-2024-3447","title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:10:36.88Z","modified":"2026-10-28T02:30:34.200621934Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-3447","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:15:17.743Z","modified":"2026-11-02T12:02:31.484523116Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2024-1491","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nQEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.(CVE-2024-24474)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:56Z","modified":"2026-08-18T01:18:24.432777681Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1494","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:56Z","modified":"2026-08-18T01:18:22.240898799Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1505","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:57Z","modified":"2026-08-18T01:18:24.600135258Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1510","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:57Z","modified":"2026-08-18T01:18:24.615300641Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1511","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:57Z","modified":"2026-08-18T01:18:24.630513111Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1516","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.(CVE-2023-0330)\r\n\r\nA double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.(CVE-2024-3446)\r\n\r\nA heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u0026gt;data_count` and the size of  `s-\u0026gt;fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.(CVE-2024-3447)","status":"published","published":"2024-04-26T11:06:57Z","modified":"2026-08-18T01:18:23.31316219Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-3447","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:15:00Z","modified":"2026-06-09T21:29:21.917498555Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"AZL-60196","title":"CVE-2024-3447 affecting package qemu for versions less than 6.2.0-24","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:15:17Z","modified":"2026-04-21T04:37:22.524275Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-60901","title":"CVE-2024-3447 affecting package qemu for versions less than 8.2.0-16","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s-\u003edata_count` and the size of  `s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","status":"published","published":"2024-11-14T12:15:17Z","modified":"2026-04-21T04:49:11.169827Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"DLA-4144-1","title":"qemu - security update","status":"published","published":"2025-04-30T00:00:00Z","modified":"2026-03-09T01:22:46.208749Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13876-1","title":"qemu-8.2.2-2.1 on GA media","description":"These are all security issues fixed in the qemu-8.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:45.217355Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1394-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n - CVE-2023-3019: Fixed heap use-after-free in e1000e_write_packet_to_guest() (bsc#1213269)\n - CVE-2023-6683: Fixed NULL pointer dereference in qemu_clipboard_request() (bsc#1218889)\n - CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134)\n - CVE-2024-3446: Fixed DM reentrancy issue that could lead to double free vulnerability (bsc#1222843)\n - CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845)\n","status":"published","published":"2024-04-23T09:16:10Z","modified":"2026-02-04T02:37:37.275335Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1438-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845)         \n- CVE-2023-6683: Fixed NULL pointer dereference in qemu_clipboard_request() (bsc#1218889)   \n- CVE-2024-3446: Fixed DMA reentrancy issue leads to double free vulnerability (bsc#1222843)\n- CVE-2023-3019: Fixed heap use-after-free in e1000e_write_packet_to_guest() (bsc#1213269)  \n","status":"published","published":"2024-04-25T21:40:20Z","modified":"2026-02-04T02:36:16.789898Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1438-2","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845)         \n- CVE-2023-6683: Fixed NULL pointer dereference in qemu_clipboard_request() (bsc#1218889)   \n- CVE-2024-3446: Fixed DMA reentrancy issue leads to double free vulnerability (bsc#1222843)\n- CVE-2023-3019: Fixed heap use-after-free in e1000e_write_packet_to_guest() (bsc#1213269)  \n","status":"published","published":"2024-04-25T21:40:40Z","modified":"2026-02-04T03:14:02.680791Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:3229-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-3447: Fix heap buffer overflow in sdhci_write_dataport(). (bsc#1218485)\n- CVE-2023-6693: Fix stack buffer overflow in virtio_net_flush_tx(). (bsc#1218484)\n","status":"published","published":"2024-09-12T13:36:07Z","modified":"2026-02-04T02:50:22.720781Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:0692-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915).\n- CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007).\n- CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845).\n\nOther fixes:\n\n- Fix ipxe build with new binutils (bsc#1219733, bsc#1219722).\n","status":"published","published":"2025-02-24T14:21:29Z","modified":"2025-05-02T04:36:47.897502Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20011-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 8.2.5:\n  * target/loongarch: fix a wrong print in cpu dump\n  * ui/sdl2: Allow host to power down screen\n  * target/i386: fix SSE and SSE2 feature check\n  * target/i386: fix xsave.flat from kvm-unit-tests\n  * disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs\n  * target/riscv/kvm.c: Fix the hart bit setting of AIA\n  * target/riscv: rvzicbo: Fixup CBO extension register calculation\n  * target/riscv: do not set mtval2 for non guest-page faults\n  * target/riscv: prioritize pmp errors in raise_mmu_exception()\n  * target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions\n  * target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w\n  * target/riscv: rvv: Check single width operator for vector fp widen instructions\n  * target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions\n  * target/riscv/cpu.c: fix Zvkb extension config\n  * target/riscv: Fix the element agnostic function problem\n  * target/riscv/kvm: tolerate KVM disable ext errors\n  * hw/intc/riscv_aplic: APLICs should add child earlier than realize\n  * iotests: test NBD+TLS+iothread\n  * qio: Inherit follow_coroutine_ctx across TLS\n  * target/arm: Disable SVE extensions when SVE is disabled\n  * hw/intc/arm_gic: Fix handling of NS view of GICC_APR\u003cn\u003e\n  * hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers\n  * gitlab: use 'setarch -R' to workaround tsan bug\n  * gitlab: use $MAKE instead of 'make'\n  * dockerfiles: add 'MAKE' env variable to remaining containers\n  * gitlab: Update msys2-64bit runner tags\n  * target/i386: no single-step exception after MOV or POP SS\n\n- Update to version 8.2.4.\n  * target/sh4: Fix SUBV opcode\n  * target/sh4: Fix ADDV opcode\n  * hw/arm/npcm7xx: Store derivative OTP fuse key in little endian\n  * hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields\n  * hw/ufs: Fix buffer overflow bug\n  * tests/avocado: update sunxi kernel from armbian to 6.6.16\n  * target/loongarch/cpu.c: typo fix: expection\n  * backends/cryptodev-builtin: Fix local_error leaks\n  * nbd/server: Mark negotiation functions as coroutine_fn\n  * nbd/server: do not poll within a coroutine context\n  * linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY\n  * target/riscv/kvm: change timer regs size to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32\n\n- Update to version 8.2.3.\n  * Update version for 8.2.3 release\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS.\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n  * hw/pci-host/ppc440_pcix: Do not expose a bridge device on PCI bus\n  * hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately\n  * virtio-pci: fix use of a released vector\n  * linux-user/x86_64: Handle the vsyscall page in open_self_maps_{2,4}\n  * hw/audio/virtio-snd: Remove unused assignment\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set\n  * hw/net/lan9118: Fix overflow in MIL TX FIFO\n  * hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition\n  * backends/cryptodev: Do not abort for invalid session ID\n  * hw/misc/applesmc: Fix memory leak in reset() handler\n  * hw/block/nand: Fix out-of-bound access in NAND block buffer\n  * hw/block/nand: Have blk_load() take unsigned offset and return boolean\n  * hw/block/nand: Factor nand_load_iolen() method out\n  * qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs\n  * mirror: Don't call job_pause_point() under graph lock (bsc#1224179)\n\n- Backports and bugfixes:\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() (bsc#1222841, CVE-2024-3567)\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446)\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447)\n  * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328)\n\n- Update to version 8.2.2\n  * chardev/char-socket: Fix TLS io channels sending too much data to the backend\n  * tests/unit/test-util-sockets: Remove temporary file after test\n  * hw/usb/bus.c: PCAP adding 0xA in Windows version\n  * hw/intc/Kconfig: Fix GIC settings when using \"--without-default-devices\"\n  * gitlab: force allow use of pip in Cirrus jobs\n  * tests/vm: avoid re-building the VM images all the time\n  * tests/vm: update openbsd image to 7.4\n  * target/i386: leave the A20 bit set in the final NPT walk\n  * target/i386: remove unnecessary/wrong application of the A20 mask\n  * target/i386: Fix physical address truncation\n  * target/i386: check validity of VMCB addresses\n  * target/i386: mask high bits of CR3 in 32-bit mode\n  * pl031: Update last RTCLR value on write in case it's read back\n  * hw/nvme: fix invalid endian conversion\n  * update edk2 binaries to edk2-stable202402\n  * update edk2 submodule to edk2-stable202402\n  * target/ppc: Fix crash on machine check caused by ifetch\n  * target/ppc: Fix lxv/stxv MSR facility check\n  * .gitlab-ci.d/windows.yml: Drop msys2-32bit job\n  * system/vl: Update description for input grab key\n  * docs/system: Update description for input grab key\n  * hw/hppa/Kconfig: Fix building with \"configure --without-default-devices\"\n  * tests/qtest: Depend on dbus_display1_dep\n  * meson: Explicitly specify dbus-display1.h dependency\n  * audio: Depend on dbus_display1_dep\n  * ui/console: Fix console resize with placeholder surface\n  * ui/clipboard: add asserts for update and request\n  * ui/clipboard: mark type as not available when there is no data\n  * ui: reject extended clipboard message if not activated\n  * target/i386: Generate an illegal opcode exception on cmp instructions with lock prefix\n  * i386/cpuid: Move leaf 7 to correct group\n  * i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F\n  * i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs\n  * i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available\n  * .gitlab-ci/windows.yml: Don't install libusb or spice packages on 32-bit\n  * iotests: Make 144 deterministic again\n  * target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU\n  * target/arm: Fix SVE/SME gross MTE suppression checks\n  * target/arm: Handle mte in do_ldrq, do_ldro\n- Address bsc#1220310. Backported upstream commits:\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n","status":"published","published":"2025-02-03T08:47:27Z","modified":"2026-03-23T04:47:06.565245Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7744-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU incorrectly handled certain virtio devices. A\nprivileged guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)\n\nIt was discovered that QEMU incorrectly handled SDHCI device emulation. A\nguest attacker could possibly use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 24.04 LTS. (CVE-2024-3447)\n\nIt was discovered that QEMU incorrectly handled calculating the checksum\nof a short-sized fragmented packet. A guest attacker could possibly use\nthis issue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)\n\nIt was discovered that the QEMU qemu-img utility incorrectly handled\ncertain crafted image files. An attacker could use this issue to cause QEMU\nto consume resources, leading to a denial of service, or possibly read and\nwrite to an existing external file. This issue only affected Ubuntu 22.04\nLTS and Ubuntu 24.04 LTS. (CVE-2024-4467)\n\nIt was discovered that QEMU incorrectly handled the RSS feature on\nvirtio-net devices. A privileged guest attacker could possibly use this\nissue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)\n\nIt was discovered that QEMU incorrectly handled the NBD server. An attacker\ncould use this issue to cause QEMU to consume resources, leading to a\ndenial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2024-7409)\n\nIt was discovered that QEMU incorrectly handled certain USB devices. A\nguest attacker could possibly use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 24.04 LTS. (CVE-2024-8354)\n\nIt was discovered that the QEMU package incorrectly set up a binfmt_misc\nregistration with the C (Credential) flag. A local attacker could use this\nwith a suid/sgid binary to escalate privileges. This update will no longer\nrun foreign-architecture binaries with suid/sgid with elevated privileges.","status":"published","published":"2025-09-11T12:41:28Z","modified":"2026-04-27T18:33:14.837287259Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}