CVE-2024-3567

2024-04-1015:16:05

CWE-617

[email protected]

web.nvd.nist.gov

qemu

assertion failure

denial of service

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

Affected configurations

Nvd

Node

qemuqemuRange8.1.0–8.2.3

qemuqemuMatch9.0.0rc0

qemuqemuMatch9.0.0rc1

qemuqemuMatch9.0.0rc2

Node

redhatenterprise_linuxMatch9.0

VendorProductVersionCPE
qemuqemu*cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
qemuqemu9.0.0cpe:2.3:a:qemu:qemu:9.0.0:rc0:*:*:*:*:*:*
qemuqemu9.0.0cpe:2.3:a:qemu:qemu:9.0.0:rc1:*:*:*:*:*:*
qemuqemu9.0.0cpe:2.3:a:qemu:qemu:9.0.0:rc2:*:*:*:*:*:*
redhatenterprise_linux9.0cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qemu	qemu	*	cpe:2.3:a:qemu:qemu::::::::
qemu	qemu	9.0.0	cpe:2.3:a:qemu:qemu:9.0.0:rc0::::::
qemu	qemu	9.0.0	cpe:2.3:a:qemu:qemu:9.0.0:rc1::::::
qemu	qemu	9.0.0	cpe:2.3:a:qemu:qemu:9.0.0:rc2::::::
redhat	enterprise_linux	9.0	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*