CVE-2024-8354

Description

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.04%• Percentile: 14%

Techniques & Countermeasures

• CWE-617•Reachable Assertion

  The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Affected Systems

• qemu•qemu

  na

• redhat•enterprise_linux

  6.0 | 7.0 | 8.0 | 9.0

References (3)

• https://access.redhat.com/security/cve/CVE-2024-8354
• https://bugzilla.redhat.com/show_bug.cgi?id=2313497
• https://security.netapp.com/advisory/ntap-20241011-0008/