Integer underflow in QEMU - CVE-2024-24474

Vulnerability identifier: #VU88538

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24474

CWE-ID: CWE-191

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer underflow within the esp_do_nodma() function in hw/scsi/esp.c. A local user can pass specially crafted data to the application, trigger an integer underflow and perform a denial of service (DoS) attack.

QEMU
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
Basesystem Module
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu-system-mips (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-system-arm
qemu
qemu-system-riscv
qemu-hw-usb-host
qemu-block-rbd
qemu-block-ssh
qemu-img
qemu-block-curl
qemu-block-iscsi
qemu-guest-agent
qemu-system-x86_64
qemu-debuginfo
qemu-debugsource
qemu-help
qemu-system-aarch64
qemu-hw-display-qxl-debuginfo
qemu-hw-display-qxl
qemu-chardev-spice-debuginfo
qemu-ui-spice-core-debuginfo
qemu-block-rbd-debuginfo
qemu-block-iscsi-debuginfo
qemu-lang
qemu-guest-agent-debuginfo
qemu-audio-dbus-debuginfo
qemu-hw-usb-host-debuginfo
qemu-ui-gtk
qemu-hw-usb-redirect
qemu-hw-usb-redirect-debuginfo
qemu-ui-gtk-debuginfo
qemu-ui-spice-core
qemu-ui-spice-app
qemu-ui-opengl-debuginfo
qemu-audio-spice-debuginfo
qemu-ui-opengl
qemu-hw-display-virtio-vga
qemu-audio-spice
qemu-chardev-spice
qemu-linux-user-debugsource
qemu-headless
qemu-tools-debuginfo
qemu-linux-user
qemu-linux-user-debuginfo
qemu-kvm
qemu-tools
qemu-chardev-baum-debuginfo
qemu-ui-dbus
qemu-chardev-baum
qemu-ui-curses-debuginfo
qemu-block-ssh-debuginfo
qemu-ui-curses
qemu-ui-dbus-debuginfo
qemu-ksm
qemu-block-curl-debuginfo
qemu-audio-dbus
qemu-accel-qtest-debuginfo
qemu-ui-spice-app-debuginfo
qemu-block-nfs
qemu-audio-oss
qemu-ivshmem-tools-debuginfo
qemu-block-dmg-debuginfo
qemu-hw-usb-smartcard-debuginfo
qemu-audio-jack
qemu-audio-jack-debuginfo
qemu-extra
qemu-block-gluster-debuginfo
qemu-extra-debuginfo
qemu-vhost-user-gpu
qemu-vhost-user-gpu-debuginfo
qemu-block-gluster
qemu-accel-qtest
qemu-hw-usb-smartcard
qemu-audio-oss-debuginfo
qemu-block-dmg
qemu-microvm
qemu-skiboot
qemu-SLOF
qemu-hw-display-virtio-gpu
qemu-hw-display-virtio-vga-debuginfo
qemu-arm-debuginfo
qemu-arm
qemu-ppc-debuginfo
qemu-ppc
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-s390x-debuginfo
qemu-s390x
qemu-hw-s390x-virtio-gpu-ccw
qemu-hw-display-virtio-gpu-pci
qemu-block-nfs-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-x86-debuginfo
qemu-x86
qemu-accel-tcg-x86
qemu-audio-pa-debuginfo
qemu-audio-pa
qemu-audio-alsa
qemu-audio-alsa-debuginfo
qemu-accel-tcg-x86-debuginfo
qemu-ivshmem-tools
qemu-sgabios

Install updates from vendor's website.

QEMU - update to 8.2.0
qemu-ipxe - update to 1.0.0+-150500.49.12.1
qemu-vgabios - update to 1.16.0_0_gd239552-150500.49.12.1
qemu-seabios - update to 1.16.0_0_gd239552-150500.49.12.1
qemu-system-mips (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-arm (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-misc (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-ppc (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-s390x (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-sparc (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-x86-xen (Ubuntu package) - update to 1:6.2+dfsg-2ubuntu6.22
qemu-system-arm - addressed in versions 6.2.0-88, 6.2.0-90
qemu - addressed in versions 6.2.0-88, 6.2.0-90
qemu-system-riscv - addressed in versions 6.2.0-88, 6.2.0-90
qemu-hw-usb-host - addressed in versions 6.2.0-88, 6.2.0-90
qemu-block-rbd - addressed in versions 6.2.0-88, 6.2.0-90
qemu-block-ssh - addressed in versions 6.2.0-88, 6.2.0-90
qemu-img - addressed in versions 6.2.0-88, 6.2.0-90
qemu-block-curl - addressed in versions 6.2.0-88, 6.2.0-90
qemu-block-iscsi - addressed in versions 6.2.0-88, 6.2.0-90
qemu-guest-agent - addressed in versions 6.2.0-88, 6.2.0-90
qemu-system-x86_64 - addressed in versions 6.2.0-88, 6.2.0-90
qemu-debuginfo - addressed in versions 6.2.0-88, 6.2.0-90
qemu-debugsource - addressed in versions 6.2.0-88, 6.2.0-90
qemu-help - addressed in versions 6.2.0-88, 6.2.0-90
qemu-seabios - addressed in versions 6.2.0-88, 6.2.0-90
qemu-system-aarch64 - addressed in versions 6.2.0-88, 6.2.0-90
qemu-hw-display-qxl-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-display-qxl - update to 7.1.0-150500.49.12.1
qemu-chardev-spice-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-spice-core-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-rbd-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-iscsi-debuginfo - update to 7.1.0-150500.49.12.1
qemu-lang - update to 7.1.0-150500.49.12.1
qemu-guest-agent-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-dbus-debuginfo - update to 7.1.0-150500.49.12.1
qemu - update to 7.1.0-150500.49.12.1
qemu-hw-usb-host-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-gtk - update to 7.1.0-150500.49.12.1
qemu-hw-usb-redirect - update to 7.1.0-150500.49.12.1
qemu-hw-usb-redirect-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-gtk-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-spice-core - update to 7.1.0-150500.49.12.1
qemu-ui-spice-app - update to 7.1.0-150500.49.12.1
qemu-ui-opengl-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-spice-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-opengl - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-vga - update to 7.1.0-150500.49.12.1
qemu-audio-spice - update to 7.1.0-150500.49.12.1
qemu-chardev-spice - update to 7.1.0-150500.49.12.1
qemu-block-rbd - update to 7.1.0-150500.49.12.1
qemu-linux-user-debugsource - update to 7.1.0-150500.49.12.1
qemu-headless - update to 7.1.0-150500.49.12.1
qemu-tools-debuginfo - update to 7.1.0-150500.49.12.1
qemu-linux-user - update to 7.1.0-150500.49.12.1
qemu-linux-user-debuginfo - update to 7.1.0-150500.49.12.1
qemu-kvm - update to 7.1.0-150500.49.12.1
qemu-tools - update to 7.1.0-150500.49.12.1
qemu-chardev-baum-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-dbus - update to 7.1.0-150500.49.12.1
qemu-block-iscsi - update to 7.1.0-150500.49.12.1
qemu-chardev-baum - update to 7.1.0-150500.49.12.1
qemu-block-ssh - update to 7.1.0-150500.49.12.1
qemu-ui-curses-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-ssh-debuginfo - update to 7.1.0-150500.49.12.1
qemu-guest-agent - update to 7.1.0-150500.49.12.1
qemu-block-curl - update to 7.1.0-150500.49.12.1
qemu-ui-curses - update to 7.1.0-150500.49.12.1
qemu-hw-usb-host - update to 7.1.0-150500.49.12.1
qemu-ui-dbus-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ksm - update to 7.1.0-150500.49.12.1
qemu-block-curl-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-dbus - update to 7.1.0-150500.49.12.1
qemu-accel-qtest-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-spice-app-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-nfs - update to 7.1.0-150500.49.12.1
qemu-audio-oss - update to 7.1.0-150500.49.12.1
qemu-ivshmem-tools-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-dmg-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-usb-smartcard-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-jack - update to 7.1.0-150500.49.12.1
qemu-audio-jack-debuginfo - update to 7.1.0-150500.49.12.1
qemu-extra - update to 7.1.0-150500.49.12.1
qemu-block-gluster-debuginfo - update to 7.1.0-150500.49.12.1
qemu-extra-debuginfo - update to 7.1.0-150500.49.12.1
qemu-vhost-user-gpu - update to 7.1.0-150500.49.12.1
qemu-debugsource - update to 7.1.0-150500.49.12.1
qemu-vhost-user-gpu-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-gluster - update to 7.1.0-150500.49.12.1
qemu-accel-qtest - update to 7.1.0-150500.49.12.1
qemu-hw-usb-smartcard - update to 7.1.0-150500.49.12.1
qemu-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-oss-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-dmg - update to 7.1.0-150500.49.12.1
qemu-microvm - update to 7.1.0-150500.49.12.1
qemu-skiboot - update to 7.1.0-150500.49.12.1
qemu-SLOF - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-vga-debuginfo - update to 7.1.0-150500.49.12.1
qemu-arm-debuginfo - update to 7.1.0-150500.49.12.1
qemu-arm - update to 7.1.0-150500.49.12.1
qemu-ppc-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ppc - update to 7.1.0-150500.49.12.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 7.1.0-150500.49.12.1
qemu-s390x-debuginfo - update to 7.1.0-150500.49.12.1
qemu-s390x - update to 7.1.0-150500.49.12.1
qemu-hw-s390x-virtio-gpu-ccw - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu-pci - update to 7.1.0-150500.49.12.1
qemu-block-nfs-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu-pci-debuginfo - update to 7.1.0-150500.49.12.1
qemu-x86-debuginfo - update to 7.1.0-150500.49.12.1
qemu-x86 - update to 7.1.0-150500.49.12.1
qemu-accel-tcg-x86 - update to 7.1.0-150500.49.12.1
qemu-audio-pa-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-pa - update to 7.1.0-150500.49.12.1
qemu-audio-alsa - update to 7.1.0-150500.49.12.1
qemu-audio-alsa-debuginfo - update to 7.1.0-150500.49.12.1
qemu-accel-tcg-x86-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ivshmem-tools - update to 7.1.0-150500.49.12.1
qemu-sgabios - update to 8-150500.49.12.1

• https://gitlab.com/qemu-project/qemu/-/issues/1810
• https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52
• https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e

• Denial of service in QEMU
• openEuler 22.03 LTS SP1 update for qemu
• openEuler 22.03 LTS SP2 update for qemu
• openEuler 22.03 LTS SP3 update for qemu
• openEuler 22.03 LTS update for qemu
• Ubuntu update for qemu
• SUSE update for qemu