Junglewise Threat Intelligence

CVE-2024-3447: QEMU heap buffer overflow in SDHCI device emulation

CVE-2024-3447 · Severity: medium · CVSS 6 · Published 2024-11-14

Executive brief

A security vulnerability exists in QEMU, a widely used tool for running virtual machines. The flaw is located in the component that simulates SD card hardware. A malicious user with high-level access inside a virtual machine could exploit this to crash the entire virtualization process on the host server, leading to a denial of service for that specific virtual environment.

Technical details

A heap-based buffer overflow (CWE-122) was identified in the SDHCI (Secure Digital Host Controller Interface) device emulation of QEMU, specifically within the sdhci_write_dataport() function. The vulnerability is triggered when a guest OS writes data to the Buffer Data Port register in a way that causes the internal data counter to exceed the allocated FIFO buffer size (typically 0x200 bytes). An attacker with high privileges (PR:H) on a guest VM can exploit this out-of-bounds access to crash the QEMU process on the host. The issue has been addressed in upstream QEMU commits and various downstream distributions like Debian and Fedora.

Affected products

  • QEMU Project QEMU versions up to (excluding) 7.2.11, versions from (including) 8.0.0 up to (excluding) 8.2.3, 9.0.0-rc0, 9.0.0-rc1, 9.0.0-rc2
  • Siemens Ruggedcom Rox II family versions before 2.17.1
  • NetApp HCI Compute Node

Timeline

  • 2024-04-09: disclosed: Initial report in Red Hat Bugzilla
  • 2024-11-12: patched: Upstream commit merged into QEMU project repository
  • 2024-11-14: advisory: NVD publication date
  • 2025-04-30: patched: Debian LTS security update released
  • 2026-05-12: advisory: Siemens advisory published for Ruggedcom Rox II family

References

Related threats