Vulnerability-Lookup

ubuntu-cve-2024-24474

Vulnerability from osv_ubuntu

Published

2024-02-20 18:15

Modified

2025-09-08 16:59

Summary

Details

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-24474	REPORT
	https://gist.github.com/1047524396/5ce07b9d387095…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-24474	REPORT
	https://ubuntu.com/security/notices/USN-6954-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-data",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:6.2+dfsg-2ubuntu6.22?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:6.2+dfsg-2ubuntu6.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:6.0+dfsg-2expubuntu1",
        "1:6.0+dfsg-2expubuntu2",
        "1:6.0+dfsg-2expubuntu4",
        "1:6.2+dfsg-2ubuntu5",
        "1:6.2+dfsg-2ubuntu6",
        "1:6.2+dfsg-2ubuntu6.1",
        "1:6.2+dfsg-2ubuntu6.2",
        "1:6.2+dfsg-2ubuntu6.3",
        "1:6.2+dfsg-2ubuntu6.4",
        "1:6.2+dfsg-2ubuntu6.5",
        "1:6.2+dfsg-2ubuntu6.6",
        "1:6.2+dfsg-2ubuntu6.7",
        "1:6.2+dfsg-2ubuntu6.8",
        "1:6.2+dfsg-2ubuntu6.9",
        "1:6.2+dfsg-2ubuntu6.10",
        "1:6.2+dfsg-2ubuntu6.11",
        "1:6.2+dfsg-2ubuntu6.12",
        "1:6.2+dfsg-2ubuntu6.13",
        "1:6.2+dfsg-2ubuntu6.14",
        "1:6.2+dfsg-2ubuntu6.15",
        "1:6.2+dfsg-2ubuntu6.16",
        "1:6.2+dfsg-2ubuntu6.17",
        "1:6.2+dfsg-2ubuntu6.18",
        "1:6.2+dfsg-2ubuntu6.19",
        "1:6.2+dfsg-2ubuntu6.21"
      ]
    }
  ],
  "aliases": [],
  "details": "QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.",
  "id": "UBUNTU-CVE-2024-24474",
  "modified": "2025-09-08T16:59:02Z",
  "published": "2024-02-20T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-24474"
    },
    {
      "type": "REPORT",
      "url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24474"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6954-1"
    }
  ],
  "related": [
    "USN-6954-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-24474"
  ]
}

CVE-2024-24474 (GCVE-0-2024-24474)

Vulnerability from cvelistv5 – Published: 2024-02-20 00:00 – Updated: 2024-08-15 20:20

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-191 - Integer Underflow (Wrap or Wraparound)
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

mitre

References

4 references

URL	Tags
https://gitlab.com/qemu-project/qemu/-/issues/1810
https://github.com/qemu/qemu/commit/77668e4b9bca0…
https://gist.github.com/1047524396/5ce07b9d387095…
https://security.netapp.com/advisory/ntap-2024051…

Impacted products

1 product

Vendor	Product	Version
qemu	qemu	Affected: 0 , < 8.2.0 (custom) cpe:2.3:a:qemu:qemu::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:19:52.622Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.com/qemu-project/qemu/-/issues/1810"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240510-0012/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "qemu",
            "vendor": "qemu",
            "versions": [
              {
                "lessThan": "8.2.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24474",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-15T20:18:14.559567Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-191",
                "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-15T20:20:15.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T16:06:52.706Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gitlab.com/qemu-project/qemu/-/issues/1810"
        },
        {
          "url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52"
        },
        {
          "url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240510-0012/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-24474",
    "datePublished": "2024-02-20T00:00:00.000Z",
    "dateReserved": "2024-01-25T00:00:00.000Z",
    "dateUpdated": "2024-08-15T20:20:15.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-6954-1

Vulnerability from osv_ubuntu

Published

2024-08-13 06:44

Modified

2026-02-10 04:45

Summary

qemu vulnerabilities

Details

Markus Frank and Fiona Ebner discovered that QEMU did not properly handle certain memory operations, leading to a NULL pointer dereference. An authenticated user could potentially use this issue to cause a denial of service. (CVE-2023-6683)

Xiao Lei discovered that QEMU did not properly handle certain memory operations when specific features were enabled, which could lead to a stack overflow. An attacker could potentially use this issue to leak sensitive information. (CVE-2023-6693)

It was discovered that QEMU had an integer underflow vulnerability in the TI command, which would result in a buffer overflow. An attacker could potentially use this issue to cause a denial of service. (CVE-2024-24474)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6954-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-6683	REPORT
	https://ubuntu.com/security/CVE-2023-6693	REPORT
	https://ubuntu.com/security/CVE-2024-24474	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-6683",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-6693",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-24474",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "qemu",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-block-extra",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-guest-agent",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-arm",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-common",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-data",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-gui",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-mips",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-misc",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-ppc",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-s390x",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-sparc",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-x86",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-x86-microvm",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-system-x86-xen",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-user",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-user-binfmt",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-user-static",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          },
          {
            "binary_name": "qemu-utils",
            "binary_version": "1:6.2+dfsg-2ubuntu6.22"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "qemu",
        "purl": "pkg:deb/ubuntu/qemu@1:6.2+dfsg-2ubuntu6.22?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:6.2+dfsg-2ubuntu6.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:6.0+dfsg-2expubuntu1",
        "1:6.0+dfsg-2expubuntu2",
        "1:6.0+dfsg-2expubuntu4",
        "1:6.2+dfsg-2ubuntu5",
        "1:6.2+dfsg-2ubuntu6",
        "1:6.2+dfsg-2ubuntu6.1",
        "1:6.2+dfsg-2ubuntu6.2",
        "1:6.2+dfsg-2ubuntu6.3",
        "1:6.2+dfsg-2ubuntu6.4",
        "1:6.2+dfsg-2ubuntu6.5",
        "1:6.2+dfsg-2ubuntu6.6",
        "1:6.2+dfsg-2ubuntu6.7",
        "1:6.2+dfsg-2ubuntu6.8",
        "1:6.2+dfsg-2ubuntu6.9",
        "1:6.2+dfsg-2ubuntu6.10",
        "1:6.2+dfsg-2ubuntu6.11",
        "1:6.2+dfsg-2ubuntu6.12",
        "1:6.2+dfsg-2ubuntu6.13",
        "1:6.2+dfsg-2ubuntu6.14",
        "1:6.2+dfsg-2ubuntu6.15",
        "1:6.2+dfsg-2ubuntu6.16",
        "1:6.2+dfsg-2ubuntu6.17",
        "1:6.2+dfsg-2ubuntu6.18",
        "1:6.2+dfsg-2ubuntu6.19",
        "1:6.2+dfsg-2ubuntu6.21"
      ]
    }
  ],
  "aliases": [],
  "details": "Markus Frank and Fiona Ebner discovered that QEMU did not properly\nhandle certain memory operations, leading to a NULL pointer dereference.\nAn authenticated user could potentially use this issue to cause a denial\nof service. (CVE-2023-6683)\n\nXiao Lei discovered that QEMU did not properly handle certain memory \noperations when specific features were enabled, which could lead to a\nstack overflow. An attacker could potentially use this issue to leak\nsensitive information. (CVE-2023-6693)\n\nIt was discovered that QEMU had an integer underflow vulnerability in \nthe TI command, which would result in a buffer overflow. An attacker\ncould potentially use this issue to cause a denial of service. \n(CVE-2024-24474)\n",
  "id": "USN-6954-1",
  "modified": "2026-02-10T04:45:02Z",
  "published": "2024-08-13T06:44:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6954-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6683"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6693"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-24474"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "qemu vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-6683",
    "UBUNTU-CVE-2023-6693",
    "UBUNTU-CVE-2024-24474"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2024-24474

Vulnerability from osv_ubuntu

CVE-2024-24474 (GCVE-0-2024-24474)

usn-6954-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature