Is CVE-2024-3447 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-3447 being exploited in the wild.

How severe is CVE-2024-3447?

Medium severity, with a CVSS score of 6, published 14 November 2024.

Which products and versions are affected?

Siemens ROX II versions before 2.17.1.

Is there a fix for CVE-2024-3447?

A patch was published on 2024-11-12: Upstream commit merged into QEMU project repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-3447 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2024-3447?

Check whether you run NetApp Hci Compute Node or Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-3447: QEMU heap buffer overflow in SDHCI device emulation

CVE-2024-3447 · Severity: medium · CVSS 6 · Published 2024-11-14

A security vulnerability exists in QEMU, a widely used tool for running virtual machines. The flaw is located in the component that simulates SD card hardware. A malicious user with high-level access inside a virtual machine could exploit this to crash the entire virtualization process on the host server, leading to a denial of service for that specific virtual environment.

Technologies: NetApp Hci Compute Node, Siemens ROX II. Vendors: NetApp, Siemens.

Quick answers

Is CVE-2024-3447 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-3447 being exploited in the wild.
How severe is CVE-2024-3447?: Medium severity, with a CVSS score of 6, published 14 November 2024.
Which products and versions are affected?: Siemens ROX II versions before 2.17.1.
Is there a fix for CVE-2024-3447?: A patch was published on 2024-11-12: Upstream commit merged into QEMU project repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-3447 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2024-3447?: Check whether you run NetApp Hci Compute Node or Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) was identified in the SDHCI (Secure Digital Host Controller Interface) device emulation of QEMU, specifically within the sdhci_write_dataport() function. The vulnerability is triggered when a guest OS writes data to the Buffer Data Port register in a way that causes the internal data counter to exceed the allocated FIFO buffer size (typically 0x200 bytes). An attacker with high privileges (PR:H) on a guest VM can exploit this out-of-bounds access to crash the QEMU process on the host. The issue has been addressed in upstream QEMU commits and various downstream distributions like Debian and Fedora.

Affected products

QEMU Project QEMU versions up to (excluding) 7.2.11, versions from (including) 8.0.0 up to (excluding) 8.2.3, 9.0.0-rc0, 9.0.0-rc1, 9.0.0-rc2
Siemens Ruggedcom Rox II family versions before 2.17.1
NetApp HCI Compute Node

Timeline

2024-04-09: disclosed: Initial report in Red Hat Bugzilla
2024-11-12: patched: Upstream commit merged into QEMU project repository
2024-11-14: advisory: NVD publication date
2025-04-30: patched: Debian LTS security update released
2026-05-12: advisory: Siemens advisory published for Ruggedcom Rox II family

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.