CVE-2024-24474
Fixed in a distro release EPSS 1%CVSS 8.8
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Products: qemu
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 1:7.2+dfsg-7+deb12u3 |
| Debian 13 | qemu | 1:8.2.0+ds-1 |
| Debian 14 | qemu | 1:8.2.0+ds-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | qemu | 6.2.0-150400.37.29.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | qemu | 6.2.0-150400.37.29.1 |
| SUSE Linux Enterprise Micro 5.3 | qemu | 6.2.0-150400.37.29.1 |
| SUSE Linux Enterprise Micro 5.4 | qemu | 6.2.0-150400.37.29.1 |
| SUSE Linux Enterprise Micro 5.5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | qemu | 6.2.0-150400.37.29.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | qemu | 6.2.0-150400.37.29.1 |
| SUSE Manager Proxy 4.3 | qemu | 6.2.0-150400.37.29.1 |
| SUSE Manager Server 4.3 | qemu | 6.2.0-150400.37.29.1 |
| Ubuntu 22.04 LTS | qemu | 1:6.2+dfsg-2ubuntu6.22 |
| openSUSE Leap 15.5 | qemu | 7.1.0-150500.49.12.1 |
| openSUSE Leap Micro 5.3 | qemu | 6.2.0-150400.37.29.1 |
| openSUSE Leap Micro 5.4 | qemu | 6.2.0-150400.37.29.1 |