CVE-2024-7409: Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

Deferred

AliasesSUSE-SU-2025:02530-1RHSA-2024:7408RHSA-2024:9912+4 more

Published 05-08-2024Last modified 09-10-2026

Vulnerability summary

CVE-2024-7409 is a high (CVSS 7.5) Improper Synchronization vulnerability in qemu. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.6% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.0 (CVE.org)

EPSS score

1.03%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 11

MGASA-2024-0387 OPENSUSE-SU-2024:14411-1 RHSA-2024:6964 RHSA-2024:9136 SUSE-SU-2024:2983-1 SUSE-SU-2024:3744-1+8 more

Timeline

05-08-2024
PublishedVulnerability first disclosed.
09-10-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

CVSS metrics

5 scores · 5 sources · 1 version

v3.07.5

EPSS trend

Probability

1.03%

Chance of exploitation in the next 30 days

Percentile

64%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.03% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-662Improper SynchronizationThe product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat43 products

qemu-guest-agent< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-guest-agent-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-img< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-img-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14

qemu-kvm-audio-dbus-debuginfo< 17:8.2.0-11.el9_4.8
qemu-kvm-audio-pa< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-audio-pa-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-block-blkio< 17:8.2.0-11.el9_4.8
qemu-kvm-block-blkio-debuginfo< 17:8.2.0-11.el9_4.8
qemu-kvm-block-curl< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-block-curl-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-block-rbd< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-block-rbd-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-common< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-common-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-core< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-core-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-debugsource< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-gpu< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-gpu-ccw< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-gpu-ccw-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-gpu-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-gpu-pci< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-gpu-pci-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-vga< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-display-virtio-vga-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-usb-host< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-usb-host-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-usb-redirect< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-device-usb-redirect-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-docs< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-tests-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-tools< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-tools-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-ui-dbus-debuginfo< 17:8.2.0-11.el9_4.8
qemu-kvm-ui-egl-headless< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-ui-egl-headless-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-ui-opengl< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-kvm-ui-opengl-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-pr-helper< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14
qemu-pr-helper-debuginfo< 17:8.2.0-11.el9_4.8 | < 17:7.2.0-14.el9_2.14

Show all 43

Suse2 products

qemu&distro=SUSE Linux Enterprise Server 12 SP5-LTSS< 3.1.1.1-78.1
qemu&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 3.1.1.1-78.1

Debian1 product

qemu< 1:5.2+dfsg-11+deb11u5 | < 1:7.2+dfsg-7+deb12u8 | < 1:9.0.2+ds-3

Ubuntu1 product

qemu< 2.0.0+dfsg-2ubuntu1.47+esm6 | < 1:2.5+dfsg-5ubuntu10.51+esm4 | < 1:6.2+dfsg-2ubuntu6.27 | < 1:8.2.2+ds-0ubuntu1.10 | < 1:2.11+dfsg-1ubuntu7.42+esm6 | < 1:4.2-3ubuntu6.30+esm2

4 vendors · 47 products