CVE-2024-24474 - OpenCVE

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e
https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52
https://gitlab.com/qemu-project/qemu/-/issues/1810
https://nvd.nist.gov/vuln/detail/CVE-2024-24474
https://security.netapp.com/advisory/ntap-20240510-0012/
https://www.cve.org/CVERecord?id=CVE-2024-24474

History

Thu, 15 Aug 2024 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-02-20T00:00:00

Updated: 2024-08-15T20:20:15.400Z

Reserved: 2024-01-25T00:00:00

Link: CVE-2024-24474

Vulnrichment

Updated: 2024-08-01T23:19:52.622Z

NVD

Status : Awaiting Analysis

Published: 2024-02-20T18:15:52.463

Modified: 2024-08-15T21:35:04.887

Link: CVE-2024-24474

Redhat

Severity : Moderate

Publid Date: 2024-02-20T00:00:00Z

Links: CVE-2024-24474 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-24474", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-15T20:20:15.400Z", "dateReserved": "2024-01-25T00:00:00", "datePublished": "2024-02-20T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-10T16:06:52.706655"}, "descriptions": [{"lang": "en", "value": "QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gitlab.com/qemu-project/qemu/-/issues/1810"}, {"url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52"}, {"url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e"}, {"url": "https://security.netapp.com/advisory/ntap-20240510-0012/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:19:52.622Z"}, "title": "CVE Program Container", "references": [{"url": "https://gitlab.com/qemu-project/qemu/-/issues/1810", "tags": ["x_transferred"]}, {"url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240510-0012/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-191", "lang": "en", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "affected": [{"vendor": "qemu", "product": "qemu", "cpes": ["cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.2.0", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T20:18:14.559567Z", "id": "CVE-2024-24474", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T20:20:15.400Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/qemu-project/qemu/-/issues/1810", "tags": ["x_transferred"]}, {"url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52", "tags": ["x_transferred"]}, {"url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240510-0012/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:19:52.622Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-24474", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-15T20:18:14.559567Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*"], "vendor": "qemu", "product": "qemu", "versions": [{"status": "affected", "version": "0", "lessThan": "8.2.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T20:20:09.851Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://gitlab.com/qemu-project/qemu/-/issues/1810"}, {"url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52"}, {"url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e"}, {"url": "https://security.netapp.com/advisory/ntap-20240510-0012/"}], "descriptions": [{"lang": "en", "value": "QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-10T16:06:52.706655"}}}, "cveMetadata": {"cveId": "CVE-2024-24474", "state": "PUBLISHED", "dateUpdated": "2024-08-15T20:20:15.400Z", "dateReserved": "2024-01-25T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-02-20T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "QEMU: esp: integer underflow leads to heap buffer overflow in esp_do_nodma()", "id": "2265499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265499"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-191->CWE-122", "details": ["QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.", "A flaw was found in the am53c974 SCSI controller emulation of QEMU. When an SCSI layer transfer is incorrectly terminated, it is possible for a TI command to cause an SCSI buffer overflow due to the expected transfer data length being less than the available data in the FIFO. When this occurs, the unsigned async_len variable underflows and becomes a large offset, which writes past the end of the allocated SCSI buffer. This flaw could allow a malicious guest to crash QEMU and cause a denial of service condition."], "name": "CVE-2024-24474", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm-ma", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "virt:rhel/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:advanced_virtualization:8::el8", "fix_state": "Not affected", "package_name": "virt:av/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8 Advanced Virtualization"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-02-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-24474\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-24474\nhttps://gitlab.com/qemu-project/qemu/-/issues/1810"], "statement": "The `qemu-kvm` versions, as shipped with Red Hat Enterprise Linux and RHEL Advanced Virtualization, are not affected by this CVE as they did not include support for the am53c974 SCSI controller emulation.", "threat_severity": "Moderate", "upstream_fix": "qemu-kvm 8.2.0"}