- Description
- A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
- Source
- patrick@puiterwijk.org
- NVD status
- Modified
- Products
- qemu, hci_compute_node
CVSS 3.1
- Type
- Secondary
- Base score
- 6
- Impact score
- 4
- Exploitability score
- 1.5
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- Severity
- MEDIUM
- patrick@puiterwijk.org
- CWE-122
- Hype score
- Not currently trending
🚨 Critical #QEMU vulnerabilities patched in #Ubuntu (USN-7744-1). CVE-2024-3446 allows guest-to-host escape & RCE. CVE-2024-3447 & CVE-2024-3567 lead to DoS. Impact: Ubuntu 22.04 LTS, 24.04 LTS. Patch NOW and restart all VMs. Read more:👉 https://t.co/twmqjxUuCm h
@Cezar_H_Linux
12 Sept 2025
89 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2024-3447 A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set t… https://t.co/a76xrfMtCi
@CVEnew
14 Nov 2024
125 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0EAD89F2-2AEA-4655-B072-E12C2AD69711",
"versionEndExcluding": "7.2.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
"matchCriteriaId": "59D5C13B-B7C8-4057-94E6-D5B29B0C745B",
"versionEndExcluding": "8.2.3",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qemu:qemu:9.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "53B020E1-1339-4E3B-8CC3-7108309DF2F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qemu:qemu:9.0.0:rc0:*:*:*:*:*:*",
"matchCriteriaId": "5E7620C7-95CD-4451-A485-69CF3752627B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qemu:qemu:9.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F8EBBE5A-0A6F-4F35-AA50-CA81B15F6BDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:qemu:qemu:9.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "45846E0D-C683-4DAF-AE17-32CD8EB283F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]