{"id":"CVE-2024-8612","aliases":["AZL-60151","AZL-60910","DEBIAN-CVE-2024-8612","EUVD-2024-49297","GHSA-whq8-5442-qhw7","MGASA-2024-0387","OESA-2024-2267","SUSE-SU-2024:3744-1","SUSE-SU-2024:3948-1","SUSE-SU-2024:4094-1","SUSE-SU-2024:4304-1","SUSE-SU-2025:0692-1","SUSE-SU-2025:20076-1","UBUNTU-CVE-2024-8612","openSUSE-SU-2024:14411-1"],"status":"published","title":"Qemu-kvm: information leak in virtio devices","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00204,"percentile":0.10447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-09-20T17:50:21Z","modified":"2026-11-02T12:03:12Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["9.1.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","fixed_in":["6.2.0-100.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"qemu","fixed_in":["4.1.0-88.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","fixed_in":["6.2.0-100.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"qemu","fixed_in":["8.2.0-19.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","fixed_in":["6.2.0-100.oe2203sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.2.0-26"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.0+ds-1","1:10.0.0+ds-2","1:10.0.0+ds-2~bpo12+1","1:10.0.0+ds-2~bpo12+2","1:10.0.0~rc0+ds-1","1:10.0.0~rc0+ds-2","1:10.0.0~rc1+ds-1","1:10.0.0~rc1+ds-2","1:10.0.0~rc2+ds-1","1:10.0.0~rc2+ds-2","1:10.0.0~rc3+ds-1","1:10.0.0~rc3+ds-2","1:10.0.2+ds-1","1:10.0.2+ds-2","1:10.0.2+ds-2~bpo12+1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0+ds-1","1:11.0.0+ds-2","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1","1:11.0.1+ds-1","1:11.0.2+ds-1","1:11.0.2+ds-2","1:11.0.2+ds-2~bpo13+1","1:11.0.3+ds-1","1:11.0.3+ds-2","1:11.1.0+ds-1","1:11.1.0+ds-2","1:11.1.0~rc0+ds-1","1:11.1.0~rc0+ds-2","1:11.1.0~rc1+ds-1","1:11.1.0~rc3+ds-1","1:11.1.0~rc3+ds-2","1:11.1.1+ds-1","1:11.1.2+ds-1","1:11.1.2+ds-1~bpo13+1","1:11.1.2+ds-2","1:11.1.2+ds-3","1:11.1.2+ds-3~bpo13+1","1:11.1.2+ds-3~bpo13+2","1:11.1.2+ds-3~bpo13+3","1:11.1.2+ds-3~bpo13+4","1:11.1.3+ds-1","1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u10","1:7.2+dfsg-7+deb12u11","1:7.2+dfsg-7+deb12u12","1:7.2+dfsg-7+deb12u13","1:7.2+dfsg-7+deb12u14","1:7.2+dfsg-7+deb12u15","1:7.2+dfsg-7+deb12u16","1:7.2+dfsg-7+deb12u17","1:7.2+dfsg-7+deb12u18","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1","1:7.2+dfsg-7+deb12u3","1:7.2+dfsg-7+deb12u4","1:7.2+dfsg-7+deb12u5","1:7.2+dfsg-7+deb12u6","1:7.2+dfsg-7+deb12u7","1:7.2+dfsg-7+deb12u8","1:7.2+dfsg-7+deb12u9","1:8.0+dfsg-1","1:8.0+dfsg-2","1:8.0+dfsg-3","1:8.0+dfsg-4","1:8.0.2+dfsg-1","1:8.0.2+dfsg-2","1:8.0.2+dfsg-3","1:8.0.3+dfsg-1","1:8.0.3+dfsg-1~bpo12+1","1:8.0.3+dfsg-2","1:8.0.3+dfsg-3","1:8.0.3+dfsg-4","1:8.0.3+dfsg-5","1:8.0.4+dfsg-1","1:8.0.4+dfsg-1~bpo12+1","1:8.0.4+dfsg-2","1:8.0.4+dfsg-3","1:8.0~rc2+dfsg-1","1:8.0~rc3+dfsg-1","1:8.0~rc3+dfsg-2","1:8.0~rc4+dfsg-1","1:8.0~rc4+dfsg-2","1:8.1.0+ds-1","1:8.1.0+ds-1~exp1","1:8.1.0+ds-1~exp2","1:8.1.0+ds-2","1:8.1.0+ds-3","1:8.1.0+ds-4","1:8.1.0+ds-5","1:8.1.0+ds-6","1:8.1.0~rc2+dfsg-1","1:8.1.0~rc3+dfsg-1","1:8.1.0~rc3+dfsg-2","1:8.1.0~rc4+ds-1","1:8.1.0~rc4+ds-2","1:8.1.0~rc4+ds-3","1:8.1.0~rc4+ds-4","1:8.1.1+ds-1","1:8.1.1+ds-2","1:8.1.1+ds-2~bpo12+1","1:8.1.2+ds-1","1:8.1.2+ds-1~bpo12+1","1:8.1.3+ds-1","1:8.2.0+ds-1","1:8.2.0+ds-2","1:8.2.0+ds-3","1:8.2.0+ds-4","1:8.2.0+ds-5","1:8.2.0+ds-5~bpo12+1","1:8.2.0~rc0+ds-1","1:8.2.0~rc1+ds-1","1:8.2.0~rc2+ds-1","1:8.2.1+ds-1","1:8.2.1+ds-1~bpo12+1","1:8.2.1+ds-2","1:8.2.2+ds-1","1:8.2.2+ds-2","1:8.2.3+ds-1","1:8.2.3+ds-2","1:8.2.4+ds-1","1:8.2.4+ds-2","1:8.2.5+ds-1","1:8.2.5+ds-2","1:9.0.0~rc0+ds-1","1:9.0.0~rc0+ds-2","1:9.0.0~rc2+ds-1","1:9.0.1+ds-1","1:9.0.1+ds-1~bpo12+1","1:9.0.2+ds-1","1:9.0.2+ds-1~bpo12+1","1:9.0.2+ds-2","1:9.0.2+ds-3","1:9.0.2+ds-4","1:9.0.2+ds-5","1:9.0.2+ds-6","1:9.0.2+ds-7","1:9.1.0+ds-1","1:9.1.0+ds-2","1:9.1.0+ds-3","1:9.1.0+ds-4","1:9.1.0+ds-5","1:9.1.0+ds-6","1:9.1.0+ds-7","1:9.1.0+ds-8","1:9.1.0+ds-9~exp0","1:9.1.0~rc0+ds-1","1:9.1.0~rc0+ds-2","1:9.1.0~rc0+ds-3","1:9.1.1+ds-1","1:9.1.1+ds-2","1:9.1.1+ds-2~bpo12+1","1:9.1.1+ds-3","1:9.1.1+ds-4","1:9.1.1+ds-5","1:9.1.2+ds-1","1:9.1.2+ds-1~bpo12+1","1:9.2.0+ds-1","1:9.2.0+ds-1~exp1","1:9.2.0+ds-2","1:9.2.0+ds-3","1:9.2.0+ds-3~bpo12+1","1:9.2.0+ds-3~bpo12+2","1:9.2.0+ds-4","1:9.2.0+ds-5","1:9.2.0~rc0+ds-1","1:9.2.0~rc3+ds-1","1:9.2.1+ds-1","1:9.2.2+ds-1","1:9.2.2+ds-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.10+ds-0+deb13u1","1:10.0.11+ds-0+deb13u1","1:10.0.13+ds-0+deb13u1","1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2","1:10.0.7+ds-0+deb13u1","1:10.0.8+ds-0+deb13u1","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0+ds-1","1:11.0.0+ds-2","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1","1:11.0.1+ds-1","1:11.0.2+ds-1","1:11.0.2+ds-2","1:11.0.2+ds-2~bpo13+1","1:11.0.3+ds-1","1:11.0.3+ds-2","1:11.1.0+ds-1","1:11.1.0+ds-2","1:11.1.0~rc0+ds-1","1:11.1.0~rc0+ds-2","1:11.1.0~rc1+ds-1","1:11.1.0~rc3+ds-1","1:11.1.0~rc3+ds-2","1:11.1.1+ds-1","1:11.1.2+ds-1","1:11.1.2+ds-1~bpo13+1","1:11.1.2+ds-2","1:11.1.2+ds-3","1:11.1.2+ds-3~bpo13+1","1:11.1.2+ds-3~bpo13+2","1:11.1.2+ds-3~bpo13+3","1:11.1.2+ds-3~bpo13+4","1:11.1.3+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0+ds-1","1:11.0.0+ds-2","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1","1:11.0.1+ds-1","1:11.0.2+ds-1","1:11.0.2+ds-2","1:11.0.2+ds-2~bpo13+1","1:11.0.3+ds-1","1:11.0.3+ds-2","1:11.1.0+ds-1","1:11.1.0+ds-2","1:11.1.0~rc0+ds-1","1:11.1.0~rc0+ds-2","1:11.1.0~rc1+ds-1","1:11.1.0~rc3+ds-1","1:11.1.0~rc3+ds-2","1:11.1.1+ds-1","1:11.1.2+ds-1","1:11.1.2+ds-1~bpo13+1","1:11.1.2+ds-2","1:11.1.2+ds-3","1:11.1.2+ds-3~bpo13+1","1:11.1.2+ds-3~bpo13+2","1:11.1.2+ds-3~bpo13+3","1:11.1.2+ds-3~bpo13+4","1:11.1.3+ds-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-100.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-88.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-100.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-19.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-100.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-15061.6.coco15sp6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-150600.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-150600.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-150600.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-150600.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-150600.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-150600.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.37.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.135.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.7-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46","2.0.0+dfsg-2ubuntu1.47","2.0.0+dfsg-2ubuntu1.47+esm1","2.0.0+dfsg-2ubuntu1.47+esm2","2.0.0+dfsg-2ubuntu1.47+esm3","2.0.0+dfsg-2ubuntu1.47+esm4","2.0.0+dfsg-2ubuntu1.47+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41","1:2.5+dfsg-5ubuntu10.42","1:2.5+dfsg-5ubuntu10.43","1:2.5+dfsg-5ubuntu10.44","1:2.5+dfsg-5ubuntu10.45","1:2.5+dfsg-5ubuntu10.46","1:2.5+dfsg-5ubuntu10.47","1:2.5+dfsg-5ubuntu10.48","1:2.5+dfsg-5ubuntu10.49","1:2.5+dfsg-5ubuntu10.51","1:2.5+dfsg-5ubuntu10.51+esm1","1:2.5+dfsg-5ubuntu10.51+esm2","1:2.5+dfsg-5ubuntu10.51+esm3","1:2.5+dfsg-5ubuntu10.51+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38","1:2.11+dfsg-1ubuntu7.39","1:2.11+dfsg-1ubuntu7.40","1:2.11+dfsg-1ubuntu7.41","1:2.11+dfsg-1ubuntu7.42","1:2.11+dfsg-1ubuntu7.42+esm1","1:2.11+dfsg-1ubuntu7.42+esm2","1:2.11+dfsg-1ubuntu7.42+esm5","1:2.11+dfsg-1ubuntu7.42+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26","1:4.2-3ubuntu6.27","1:4.2-3ubuntu6.28","1:4.2-3ubuntu6.29","1:4.2-3ubuntu6.30","1:4.2-3ubuntu6.30+esm1","1:4.2-3ubuntu6.30+esm2","1:4.2-3ubuntu6.30+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26","1:6.2+dfsg-2ubuntu6.27","1:6.2+dfsg-2ubuntu6.28","1:6.2+dfsg-2ubuntu6.29","1:6.2+dfsg-2ubuntu6.30","1:6.2+dfsg-2ubuntu6.31"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12","1:8.2.2+ds-0ubuntu1.13","1:8.2.2+ds-0ubuntu1.14","1:8.2.2+ds-0ubuntu1.15","1:8.2.2+ds-0ubuntu1.16","1:8.2.2+ds-0ubuntu1.17","1:8.2.2+ds-0ubuntu1.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2","1:10.1.0+ds-5ubuntu2.4","1:10.1.0+ds-5ubuntu2.5","1:10.1.0+ds-5ubuntu2.6","1:10.1.0+ds-5ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu6","1:11.0.3+ds-2ubuntu1","1:11.0.3+ds-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu7","1:10.2.1+ds-1ubuntu8","1:11.0.3+ds-2ubuntu2","1:11.0.3+ds-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu3","1:10.1.0+ds-5ubuntu4","1:10.1.0+ds-5ubuntu5","1:10.2.1+ds-1ubuntu1","1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu3.1","1:10.2.1+ds-1ubuntu3.2","1:10.2.1+ds-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu4.2","1:10.2.1+ds-1ubuntu4.3","1:10.2.1+ds-1ubuntu4.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0-2.1"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8 advanced virtualization"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-8612","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2313760","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.com/qemu-project/qemu/-/commit/637b0aa139565cb82a7b9269e62214f87082635c","tags":["fix"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0006/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8612","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0006"},{"url":"https://github.com/advisories/GHSA-whq8-5442-qhw7"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8612.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-8612","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2267","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243744-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224132","tags":["report"]},{"url":"https://bugzilla.suse.com/1229007","tags":["report"]},{"url":"https://bugzilla.suse.com/1229929","tags":["report"]},{"url":"https://bugzilla.suse.com/1230140","tags":["report"]},{"url":"https://bugzilla.suse.com/1230834","tags":["report"]},{"url":"https://bugzilla.suse.com/1230915","tags":["report"]},{"url":"https://bugzilla.suse.com/1231519","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8612","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243948-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244094-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244304-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250692-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219722","tags":["report"]},{"url":"https://bugzilla.suse.com/1219733","tags":["report"]},{"url":"https://bugzilla.suse.com/1222845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3447","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520076-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8612","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8612","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EPDARJICNXP6BQXL6RDWC63AJMWSDEU5/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4467","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-8612","title":"Qemu-kvm: information leak in virtio devices","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T17:50:21.635Z","modified":"2026-11-06T14:57:34.834Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-06T15:28:32.799664Z"}],"euvd":[{"id":"EUVD-2024-49297","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T17:50:21Z","modified":"2026-11-06T14:57:34Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-06T16:05:20.373498Z"}],"ghsa":[{"id":"GHSA-whq8-5442-qhw7","title":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for...","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T18:32:27Z","modified":"2025-10-02T18:31:57Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:03:50.19975Z"}],"nvd":[{"id":"CVE-2024-8612","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T18:15:04.743Z","modified":"2026-11-06T15:17:04.37Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-06T18:00:49.117518Z"}],"osv":[{"id":"AZL-60151","title":"CVE-2024-8612 affecting package qemu 6.2.0-26","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T18:15:04Z","modified":"2026-04-21T04:37:22.303173Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-60910","title":"CVE-2024-8612 affecting package qemu for versions less than 9.1.0-1","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T18:15:04Z","modified":"2026-09-10T14:16:25.558996106Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"CVE-2024-8612","title":"Qemu-kvm: information leak in virtio devices","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T17:50:21.635Z","modified":"2026-11-08T13:15:17.485436931Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-07T03:07:55.074849Z"},{"id":"DEBIAN-CVE-2024-8612","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T18:15:04.743Z","modified":"2026-11-07T09:47:27.226829098Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2024-2267","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.(CVE-2024-8612)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:34.450133096Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-8612","description":"A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.","status":"published","published":"2024-09-20T18:15:00Z","modified":"2026-10-22T23:20:07.054443931Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14411-1","title":"qemu-9.1.0-2.1 on GA media","description":"These are all security issues fixed in the qemu-9.1.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-18T00:00:00Z","modified":"2026-02-04T02:43:49.319974Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3744-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2024-8354: Fixed assertion failure in usb_ep_get() (bsc#1230834)\n- CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915)\n\nUpdate version to 8.2.7:\n\nSecurity fixes:\n\n- CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007) \n- CVE-2024-4693: Fixed improper release of configure vector in virtio-pci that lead to guest triggerable crash (bsc#1224132)\n\nOther fixes:\n\n- added missing fix for ppc64 emulation that caused corruption in userspace (bsc#1230140)\n- target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)\n- accel/kvm: check for KVM_CAP_READONLY_MEM on VM (bsc#1231519)\n\nFull changelog here: \n\nhttps://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/\n","status":"published","published":"2024-10-22T13:34:33Z","modified":"2026-02-04T03:27:14.55429Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3948-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-8354: Fixed assertion failure in usb_ep_get() (bsc#1230834).\n- CVE-2024-8612: Fixed nformation leak in virtio devices (bsc#1230915).\n- CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007).\n","status":"published","published":"2024-11-08T07:28:34Z","modified":"2026-02-04T03:10:29.434715Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4094-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2024-8354: Fixed assertion failure in usb_ep_get() (bsc#1230834)\n- CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915)\n\nUpdate version to 8.2.7:\n\nSecurity fixes:\n\n- CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007) \n- CVE-2024-4693: Fixed improper release of configure vector in virtio-pci that lead to guest triggerable crash (bsc#1224132)\n\nOther fixes:\n\n- added missing fix for ppc64 emulation that caused corruption in userspace (bsc#1230140)\n- target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)\n- accel/kvm: check for KVM_CAP_READONLY_MEM on VM (bsc#1231519)\n\nFull changelog here: \n\nhttps://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/\n","status":"published","published":"2024-11-28T11:56:42Z","modified":"2026-02-04T03:13:45.902536Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4304-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)\n- CVE-2024-8354: Fixed assertion failure in usb_ep_get() in usb (bsc#1230834)\n- CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915)\n","status":"published","published":"2024-12-12T13:22:08Z","modified":"2026-02-04T03:16:45.509918Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:0692-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-8612: Fixed information leak in virtio devices (bsc#1230915).\n- CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007).\n- CVE-2024-3447: Fixed heap buffer overflow in sdhci_write_dataport() (bsc#1222845).\n\nOther fixes:\n\n- Fix ipxe build with new binutils (bsc#1219733, bsc#1219722).\n","status":"published","published":"2025-02-24T14:21:29Z","modified":"2025-05-02T04:36:47.897502Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20076-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Bugfixes and CVEs:\n  * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354)\n  * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612)\n  * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612)\n  * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612)\n  * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612)\n\n- Update version to 8.2.7\n  * Full changelog here:\n     https://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/\n  * Fixes:\n     bsc#1229007, CVE-2024-7409\n     bsc#1224132, CVE-2024-4693\n  * Some backports:\n     gitlab: fix logic for changing docker tag on stable branches\n     ui/sdl2: set swap interval explicitly when OpenGL is enabled\n     hw/intc/arm_gic: fix spurious level triggered interrupts\n     hw/audio/virtio-sound: fix heap buffer overflow\n     tests/docker: update debian i686 and mipsel images to bookworm\n     tests/docker: remove debian-armel-cross\n     hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()\n     crypto: check gnutls \u0026 gcrypt support the requested pbkdf hash\n     crypto: run qcrypto_pbkdf2_count_iters in a new thread\n     softmmu/physmem: fix memory leak in dirty_memory_extend()\n     target/ppc: Fix migration of CPUs with TLB_EMB TLB type\n     gitlab: migrate the s390x custom machine to 22.04\n     target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64\n     hw/audio/virtio-snd: fix invalid param check\n     virtio-pci: Fix the use of an uninitialized irqfd\n- Fix bsc#1231519:\n  * accel/kvm: check for KVM_CAP_READONLY_MEM on VM (bsc#1231519)\n","status":"published","published":"2025-02-03T09:05:11Z","modified":"2026-03-23T04:48:52.180501Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}