CVE-2024-24474: Buffer Overflow
Last updated 13 August 2024
Other sources
QEMU before 8.2.0 has an integer underflow and resultant buffer overflow via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in espdonodma in hw/scsi/esp.c because of an underflow of asynclen.
— Microsoft
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in espdonodma in hw/scsi/esp.c because of an underflow of asynclen.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u7Fixed in 1:9.0.2+ds-2Fixed in 1:9.1.0+ds-3 - Upgrade
Upgrade
qemuto a version that resolves this vulnerability.Fixed in 8.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24474?
CVE-2024-24474 is classified as a high severity vulnerability due to the potential for an integer underflow leading to a buffer overflow.
How do I fix CVE-2024-24474?
To fix CVE-2024-24474, update to QEMU versions 8.2.0 or later to ensure the integer underflow is addressed.
What causes CVE-2024-24474?
CVE-2024-24474 is caused by an integer underflow in the esp_do_nodma function, affecting non-DMA transfer lengths in QEMU.
Which versions of QEMU are affected by CVE-2024-24474?
QEMU versions prior to 8.2.0 are affected by CVE-2024-24474, including specific versions like 1:5.2+dfsg-11 and 1:9.1.0+ds-3.
Can CVE-2024-24474 lead to remote exploitation?
Yes, CVE-2024-24474 has the potential to be exploited remotely, which can allow attackers to execute arbitrary code.