REDHAT-BUG-2274123: Buffer Overflow
First published: Tue Apr 09 2024(Updated: )
A heap based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Upstream patch: <a href="https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/">https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/</a> oss-fuzz bug: <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813">https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2274124
- https://patchew.org/QEMU/20240409145524.27913-1-philmd@linaro.org/
- https://gitlab.com/qemu-project/qemu/-/commit/9e4b27ca6bf4974f169bbca7f3dca117b1208b6f
- https://bugzilla.redhat.com/show_bug.cgi?id=2274123
Frequently Asked Questions
What is the severity of REDHAT-BUG-2274123?
REDHAT-BUG-2274123 is categorized as a critical vulnerability due to its potential to crash the QEMU process.
How do I fix REDHAT-BUG-2274123?
To fix REDHAT-BUG-2274123, update QEMU to the latest version that has addressed this heap-based buffer overflow.
Who is affected by REDHAT-BUG-2274123?
Users running vulnerable versions of QEMU are affected by REDHAT-BUG-2274123.
What causes the vulnerability REDHAT-BUG-2274123?
REDHAT-BUG-2274123 is caused by a heap-based buffer overflow triggered when specific parameters in the SDHCI device emulation are set incorrectly.
Can a malicious guest exploit REDHAT-BUG-2274123?
Yes, a malicious guest can exploit REDHAT-BUG-2274123 to crash the QEMU process on the host.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-3447
- agent/severity
- agent/weakness
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/qemu
- canonical/qemu