CVE-2024-3447

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3447
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
CVSS

No CVSS.

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-3447 Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 Exploit Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2274123 Issue Tracking Third Party Advisory
https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/ Broken Link
https://security.netapp.com/advisory/ntap-20250425-0005/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:qemu:qemu:9.0.0:rc0:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:9.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:9.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:9.0.0:-:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
History

05 Aug 2025, 18:33

Type Values Removed Values Added
CPE cpe:2.3:a:qemu:qemu:9.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:9.0.0:rc0:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:9.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:9.0.0:-:*:*:*:*:*:*
First Time Qemu qemu
Netapp hci Compute Node
Netapp
Qemu
References () https://security.netapp.com/advisory/ntap-20250425-0005/ - () https://security.netapp.com/advisory/ntap-20250425-0005/ - Vendor Advisory
References () https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/ - () https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/ - Broken Link
References () https://access.redhat.com/security/cve/CVE-2024-3447 - () https://access.redhat.com/security/cve/CVE-2024-3447 - Third Party Advisory
References () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 - () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 - Exploit, Issue Tracking
References () https://bugzilla.redhat.com/show_bug.cgi?id=2274123 - () https://bugzilla.redhat.com/show_bug.cgi?id=2274123 - Issue Tracking, Third Party Advisory

25 Apr 2025, 23:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250425-0005/ -

14 Nov 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-14 12:15

Updated : 2025-08-05 18:33

NVD link : CVE-2024-3447

Mitre link : CVE-2024-3447

JSON object : View

Products Affected

qemu

  • qemu

netapp

  • hci_compute_node
CWE

No CWE.