CVE-2024-3447: Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()
First published: Tue Apr 09 2024(Updated: )
A heap based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Upstream patch: <a href="https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/">https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/</a> oss-fuzz bug: <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813</a>
Credit: patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2274124
- https://patchew.org/QEMU/20240409145524.27913-1-philmd@linaro.org/
- https://gitlab.com/qemu-project/qemu/-/commit/9e4b27ca6bf4974f169bbca7f3dca117b1208b6f
- https://bugzilla.redhat.com/show_bug.cgi?id=2274123
- https://access.redhat.com/security/cve/CVE-2024-3447
- https://security.netapp.com/advisory/ntap-20250425-0005/
Frequently Asked Questions
What is the severity of CVE-2024-3447?
CVE-2024-3447 is classified as a critical vulnerability due to the potential for a heap-based buffer overflow leading to crashes.
How do I fix CVE-2024-3447?
To mitigate CVE-2024-3447, update to the latest version of QEMU that addresses this vulnerability.
What causes CVE-2024-3447?
CVE-2024-3447 is triggered when both 's->data_count' and the size of 's->fifo_buffer' are incorrectly set, leading to out-of-bounds access.
Who is impacted by CVE-2024-3447?
Any system using vulnerable versions of QEMU may be impacted by CVE-2024-3447, especially if it processes untrusted guest data.
What are the consequences of exploiting CVE-2024-3447?
Exploitation of CVE-2024-3447 can lead to a crash of the QEMU process, resulting in denial of service.
- agent/weakness
- agent/title
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-3447
- agent/references
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/qemu
- canonical/qemu