{"id":"CVE-2024-3567","aliases":["AZL-43050","BELL-CVE-2024-3567","DEBIAN-CVE-2024-3567","EUVD-2024-32153","GHSA-mqq7-33jf-2x53","RHSA-2025:4492","RLSA-2025:4492","SUSE-SU-2025:20011-1","UBUNTU-CVE-2024-3567","USN-7744-1","openSUSE-SU-2024:13876-1"],"status":"published","title":"Qemu-kvm: net: assertion failure in update_sctp_checksum()","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00445,"percentile":0.38981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2024-04-10T14:32:02Z","modified":"2026-11-05T21:16:06Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-16"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"qemu","fixed_in":["9.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-16"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"},{"fixed":"9.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:9.0.0-10.el9_5.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.5-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.10"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.27"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.10"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-2.1"}]}],"bundled":4}],"products":[{"vendor":"qemu","product":"qemu"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8 advanced virtualization"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:4492","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3567","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274339","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","report"]},{"url":"https://gitlab.com/qemu-project/qemu/-/issues/2273","tags":["x_transferred","Exploit","Issue Tracking","report","article"]},{"url":"https://security.netapp.com/advisory/ntap-20240822-0007/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3567","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240822-0007"},{"url":"https://github.com/advisories/GHSA-mqq7-33jf-2x53"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-3567","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-55","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3567.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3567","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254580","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4492.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6693","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3567","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:4492","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084909","tags":["report"]},{"url":"https://bugzilla.suse.com/1220065","tags":["report"]},{"url":"https://bugzilla.suse.com/1220310","tags":["report"]},{"url":"https://bugzilla.suse.com/1222218","tags":["report"]},{"url":"https://bugzilla.suse.com/1222841","tags":["report"]},{"url":"https://bugzilla.suse.com/1222843","tags":["report"]},{"url":"https://bugzilla.suse.com/1222845","tags":["report"]},{"url":"https://bugzilla.suse.com/1224179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3567","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-3567","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7744-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-7409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8354","tags":["report"]},{"url":"https://bugs.launchpad.net/bugs/2120814","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-3567","title":"Qemu-kvm: net: assertion failure in update_sctp_checksum()","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T14:32:02.343Z","modified":"2026-11-05T12:18:13.135Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-32153","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T14:32:02Z","modified":"2026-11-05T12:18:13Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-mqq7-33jf-2x53","title":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function...","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T15:30:40Z","modified":"2025-05-06T09:31:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:02:08.502889Z"}],"nvd":[{"id":"CVE-2024-3567","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T15:16:05.097Z","modified":"2026-11-05T13:17:02.533Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-05T19:55:48.976368Z"}],"osv":[{"id":"AZL-43050","title":"CVE-2024-3567 affecting package qemu for versions less than 8.2.0-16","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T15:16:05Z","modified":"2026-04-21T04:49:42.563651Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"BELL-CVE-2024-3567","status":"published","published":"2024-04-11T05:57:08.134039Z","modified":"2026-01-26T09:36:34.840749Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.923987Z"},{"id":"CVE-2024-3567","title":"Qemu-kvm: net: assertion failure in update_sctp_checksum()","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T14:32:02.343Z","modified":"2026-11-07T02:30:30.591581874Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-07T03:07:53.148204Z"},{"id":"DEBIAN-CVE-2024-3567","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T15:16:05.097Z","modified":"2026-11-02T12:02:31.873552054Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"RHSA-2025:4492","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2025-05-06T10:04:01Z","modified":"2026-06-28T11:34:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:4492","title":"Moderate: qemu-kvm security update","description":"Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx() (CVE-2023-6693)\n\n* qemu-kvm: net: assertion failure in update_sctp_checksum() (CVE-2024-3567)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-07-29T15:00:31.352141Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2024-3567","description":"A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.","status":"published","published":"2024-04-10T15:16:00Z","modified":"2026-02-04T04:06:45.954532Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"openSUSE-SU-2024:13876-1","title":"qemu-8.2.2-2.1 on GA media","description":"These are all security issues fixed in the qemu-8.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:45.217355Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2025:20011-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 8.2.5:\n  * target/loongarch: fix a wrong print in cpu dump\n  * ui/sdl2: Allow host to power down screen\n  * target/i386: fix SSE and SSE2 feature check\n  * target/i386: fix xsave.flat from kvm-unit-tests\n  * disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs\n  * target/riscv/kvm.c: Fix the hart bit setting of AIA\n  * target/riscv: rvzicbo: Fixup CBO extension register calculation\n  * target/riscv: do not set mtval2 for non guest-page faults\n  * target/riscv: prioritize pmp errors in raise_mmu_exception()\n  * target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions\n  * target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w\n  * target/riscv: rvv: Check single width operator for vector fp widen instructions\n  * target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions\n  * target/riscv/cpu.c: fix Zvkb extension config\n  * target/riscv: Fix the element agnostic function problem\n  * target/riscv/kvm: tolerate KVM disable ext errors\n  * hw/intc/riscv_aplic: APLICs should add child earlier than realize\n  * iotests: test NBD+TLS+iothread\n  * qio: Inherit follow_coroutine_ctx across TLS\n  * target/arm: Disable SVE extensions when SVE is disabled\n  * hw/intc/arm_gic: Fix handling of NS view of GICC_APR\u003cn\u003e\n  * hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers\n  * gitlab: use 'setarch -R' to workaround tsan bug\n  * gitlab: use $MAKE instead of 'make'\n  * dockerfiles: add 'MAKE' env variable to remaining containers\n  * gitlab: Update msys2-64bit runner tags\n  * target/i386: no single-step exception after MOV or POP SS\n\n- Update to version 8.2.4.\n  * target/sh4: Fix SUBV opcode\n  * target/sh4: Fix ADDV opcode\n  * hw/arm/npcm7xx: Store derivative OTP fuse key in little endian\n  * hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields\n  * hw/ufs: Fix buffer overflow bug\n  * tests/avocado: update sunxi kernel from armbian to 6.6.16\n  * target/loongarch/cpu.c: typo fix: expection\n  * backends/cryptodev-builtin: Fix local_error leaks\n  * nbd/server: Mark negotiation functions as coroutine_fn\n  * nbd/server: do not poll within a coroutine context\n  * linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY\n  * target/riscv/kvm: change timer regs size to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32\n\n- Update to version 8.2.3.\n  * Update version for 8.2.3 release\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS.\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n  * hw/pci-host/ppc440_pcix: Do not expose a bridge device on PCI bus\n  * hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately\n  * virtio-pci: fix use of a released vector\n  * linux-user/x86_64: Handle the vsyscall page in open_self_maps_{2,4}\n  * hw/audio/virtio-snd: Remove unused assignment\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set\n  * hw/net/lan9118: Fix overflow in MIL TX FIFO\n  * hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition\n  * backends/cryptodev: Do not abort for invalid session ID\n  * hw/misc/applesmc: Fix memory leak in reset() handler\n  * hw/block/nand: Fix out-of-bound access in NAND block buffer\n  * hw/block/nand: Have blk_load() take unsigned offset and return boolean\n  * hw/block/nand: Factor nand_load_iolen() method out\n  * qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs\n  * mirror: Don't call job_pause_point() under graph lock (bsc#1224179)\n\n- Backports and bugfixes:\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() (bsc#1222841, CVE-2024-3567)\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446)\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447)\n  * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328)\n\n- Update to version 8.2.2\n  * chardev/char-socket: Fix TLS io channels sending too much data to the backend\n  * tests/unit/test-util-sockets: Remove temporary file after test\n  * hw/usb/bus.c: PCAP adding 0xA in Windows version\n  * hw/intc/Kconfig: Fix GIC settings when using \"--without-default-devices\"\n  * gitlab: force allow use of pip in Cirrus jobs\n  * tests/vm: avoid re-building the VM images all the time\n  * tests/vm: update openbsd image to 7.4\n  * target/i386: leave the A20 bit set in the final NPT walk\n  * target/i386: remove unnecessary/wrong application of the A20 mask\n  * target/i386: Fix physical address truncation\n  * target/i386: check validity of VMCB addresses\n  * target/i386: mask high bits of CR3 in 32-bit mode\n  * pl031: Update last RTCLR value on write in case it's read back\n  * hw/nvme: fix invalid endian conversion\n  * update edk2 binaries to edk2-stable202402\n  * update edk2 submodule to edk2-stable202402\n  * target/ppc: Fix crash on machine check caused by ifetch\n  * target/ppc: Fix lxv/stxv MSR facility check\n  * .gitlab-ci.d/windows.yml: Drop msys2-32bit job\n  * system/vl: Update description for input grab key\n  * docs/system: Update description for input grab key\n  * hw/hppa/Kconfig: Fix building with \"configure --without-default-devices\"\n  * tests/qtest: Depend on dbus_display1_dep\n  * meson: Explicitly specify dbus-display1.h dependency\n  * audio: Depend on dbus_display1_dep\n  * ui/console: Fix console resize with placeholder surface\n  * ui/clipboard: add asserts for update and request\n  * ui/clipboard: mark type as not available when there is no data\n  * ui: reject extended clipboard message if not activated\n  * target/i386: Generate an illegal opcode exception on cmp instructions with lock prefix\n  * i386/cpuid: Move leaf 7 to correct group\n  * i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F\n  * i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs\n  * i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available\n  * .gitlab-ci/windows.yml: Don't install libusb or spice packages on 32-bit\n  * iotests: Make 144 deterministic again\n  * target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU\n  * target/arm: Fix SVE/SME gross MTE suppression checks\n  * target/arm: Handle mte in do_ldrq, do_ldro\n- Address bsc#1220310. Backported upstream commits:\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n","status":"published","published":"2025-02-03T08:47:27Z","modified":"2026-03-23T04:47:06.565245Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7744-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU incorrectly handled certain virtio devices. A\nprivileged guest attacker could use this issue to cause QEMU to crash,\nleading to a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)\n\nIt was discovered that QEMU incorrectly handled SDHCI device emulation. A\nguest attacker could possibly use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 24.04 LTS. (CVE-2024-3447)\n\nIt was discovered that QEMU incorrectly handled calculating the checksum\nof a short-sized fragmented packet. A guest attacker could possibly use\nthis issue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)\n\nIt was discovered that the QEMU qemu-img utility incorrectly handled\ncertain crafted image files. An attacker could use this issue to cause QEMU\nto consume resources, leading to a denial of service, or possibly read and\nwrite to an existing external file. This issue only affected Ubuntu 22.04\nLTS and Ubuntu 24.04 LTS. (CVE-2024-4467)\n\nIt was discovered that QEMU incorrectly handled the RSS feature on\nvirtio-net devices. A privileged guest attacker could possibly use this\nissue to cause QEMU to crash, leading to a denial of service. This\nissue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)\n\nIt was discovered that QEMU incorrectly handled the NBD server. An attacker\ncould use this issue to cause QEMU to consume resources, leading to a\ndenial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n24.04 LTS. (CVE-2024-7409)\n\nIt was discovered that QEMU incorrectly handled certain USB devices. A\nguest attacker could possibly use this issue to cause QEMU to crash,\nleading to a denial of service. This issue only affected Ubuntu 22.04 LTS\nand Ubuntu 24.04 LTS. (CVE-2024-8354)\n\nIt was discovered that the QEMU package incorrectly set up a binfmt_misc\nregistration with the C (Credential) flag. A local attacker could use this\nwith a suid/sgid binary to escalate privileges. This update will no longer\nrun foreign-architecture binaries with suid/sgid with elevated privileges.","status":"published","published":"2025-09-11T12:41:28Z","modified":"2026-04-27T18:33:14.837287259Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}