CVE-2024-8354: Qemu-kvm: usb: assertion failure in usb_ep_get()
A flaw was found in QEMU. An assertion failure was present in the usbepget() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.
Other sources
An assertion failure was found in QEMU in the usbepget() function in hw/net/core.c. The TD PID needs to be either USBTOKENIN or USBTOKENOUT in usbepget, but in the caller uhcihandletd it may be USBTOKENSETUP.
An unprivileged guest user may be able to reach the assertion. Users are not directly able to craft URBs, however as a user, one might be able to find a kernel path that would send a TD with PID USBTOKENSETUP to QEMU (which is called USBPIDSETUP in Linux). For instance in the Linux Kernel, uhcisubmitcontrol in drivers/usb/host/uhci-q.c:789 does link a USBPIDSETUP TD to the URB.
Upstream issue: https://gitlab.com/qemu-project/qemu/-/issues/2548
— Red Hat
Qemu-kvm: usb: assertion failure in usbepget()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.0-27 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.1.0-3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8354?
CVE-2024-8354 is classified with a severity level that indicates potential denial of service risks for QEMU users.
How do I fix CVE-2024-8354?
To fix CVE-2024-8354, users should update QEMU to the latest version that includes patches for this vulnerability.
What impact does CVE-2024-8354 have on affected systems?
CVE-2024-8354 may allow unprivileged guest users to crash the QEMU process, leading to a denial of service.
Which versions of QEMU are affected by CVE-2024-8354?
CVE-2024-8354 affects multiple versions of QEMU across various distributions, including those running on Red Hat Enterprise Linux.
Is CVE-2024-8354 exploitable remotely?
CVE-2024-8354 is considered a denial of service vulnerability that could be exploited locally by unprivileged guest users.