CVE-2024-24474

2024-02-2018:15:52

Debian Security Bug Tracker

security-tracker.debian.org

qemu

integer underflow

buffer overflow

ti command

non-dma transfer

fifo data

esp_do_nodma

async_len

unix

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

Percentile

15.5%

JSON

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.

OSVersionArchitecturePackageVersionFilename
Debian12allqemu< 1:7.2+dfsg-7+deb12u3qemu_1:7.2+dfsg-7+deb12u3_all.deb
Debian11allqemu< 1:5.2+dfsg-11+deb11u3qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian999allqemu< 1:8.2.0+ds-1qemu_1:8.2.0+ds-1_all.deb
Debian13allqemu< 1:8.2.0+ds-1qemu_1:8.2.0+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	qemu	< 1:7.2+dfsg-7+deb12u3	qemu_1:7.2+dfsg-7+deb12u3_all.deb
Debian	11	all	qemu	< 1:5.2+dfsg-11+deb11u3	qemu_1:5.2+dfsg-11+deb11u3_all.deb
Debian	999	all	qemu	< 1:8.2.0+ds-1	qemu_1:8.2.0+ds-1_all.deb
Debian	13	all	qemu	< 1:8.2.0+ds-1	qemu_1:8.2.0+ds-1_all.deb