# CVE-2024-3447: QEMU heap buffer overflow in SDHCI device emulation

Source: https://junglewise.ai/threats/cve-2024-3447-qemu-heap-buffer-overflow-in-sdhci-device-emulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-14. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-3447 · Severity: medium · CVSS 6 · Published 2024-11-14

A security vulnerability exists in QEMU, a widely used tool for running virtual machines. The flaw is located in the component that simulates SD card hardware. A malicious user with high-level access inside a virtual machine could exploit this to crash the entire virtualization process on the host server, leading to a denial of service for that specific virtual environment.

Technologies: [NetApp Hci Compute Node](https://junglewise.ai/threats/technologies/hci-compute-node), [Siemens ROX II](https://junglewise.ai/threats/technologies/rox-ii). Vendors: [NetApp](https://junglewise.ai/threats/vendors/netapp), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2024-3447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-3447 being exploited in the wild.

**How severe is CVE-2024-3447?** Medium severity, with a CVSS score of 6, published 14 November 2024.

**Which products and versions are affected?** Siemens ROX II versions before 2.17.1.

**Is there a fix for CVE-2024-3447?** A patch was published on 2024-11-12: Upstream commit merged into QEMU project repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-3447 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2024-3447?** Check whether you run NetApp Hci Compute Node or Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) was identified in the SDHCI (Secure Digital Host Controller Interface) device emulation of QEMU, specifically within the sdhci_write_dataport() function. The vulnerability is triggered when a guest OS writes data to the Buffer Data Port register in a way that causes the internal data counter to exceed the allocated FIFO buffer size (typically 0x200 bytes). An attacker with high privileges (PR:H) on a guest VM can exploit this out-of-bounds access to crash the QEMU process on the host. The issue has been addressed in upstream QEMU commits and various downstream distributions like Debian and Fedora.

## Affected products

- QEMU Project QEMU versions up to (excluding) 7.2.11, versions from (including) 8.0.0 up to (excluding) 8.2.3, 9.0.0-rc0, 9.0.0-rc1, 9.0.0-rc2
- Siemens Ruggedcom Rox II family versions before 2.17.1
- NetApp HCI Compute Node

## Timeline

- 2024-04-09: disclosed: Initial report in Red Hat Bugzilla
- 2024-11-12: patched: Upstream commit merged into QEMU project repository
- 2024-11-14: advisory: NVD publication date
- 2025-04-30: patched: Debian LTS security update released
- 2026-05-12: advisory: Siemens advisory published for Ruggedcom Rox II family

## References

- [https://access.redhat.com/security/cve/CVE-2024-3447](https://access.redhat.com/security/cve/CVE-2024-3447)
- [https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2274123](https://bugzilla.redhat.com/show_bug.cgi?id=2274123)
- [https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/](https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/)
- [https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html](https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html)
- [https://security.netapp.com/advisory/ntap-20250425-0005/](https://security.netapp.com/advisory/ntap-20250425-0005/)
- [https://cert-portal.siemens.com/productcert/html/ssa-577017.html](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)

## Related threats

- [GNOME libxml2 stack overflow in XPath evaluation](https://junglewise.ai/threats/cve-2025-9714-gnome-libxml2-stack-overflow-in-xpath-evaluation)
- [GNU glibc denial of service in nscd netgroup cache](https://junglewise.ai/threats/cve-2024-33601-gnu-glibc-denial-of-service-in-nscd-netgroup-cache)
- [Denx Das U-Boot stack buffer overflow in i2c md command](https://junglewise.ai/threats/cve-2022-34835-denx-das-u-boot-stack-buffer-overflow-in-i2c-md-command)
- [Linux Kernel out-of-bounds read in nfsd tracepoint](https://junglewise.ai/threats/cve-2021-38202-linux-kernel-out-of-bounds-read-in-nfsd-tracepoint)
- [Das U-Boot integer underflow in ext4 filesystem parsing](https://junglewise.ai/threats/cve-2019-13104-das-u-boot-integer-underflow-in-ext4-filesystem-parsing)