CVE-2024-8354

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
redhatCNA
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
VendorProductVersion
qemuqemu
-
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qemu
bullseye
postponed
trixie
no-dsa
bookworm
no-dsa
bullseye (security)
vulnerable
bookworm (security)
vulnerable
trixie (security)
vulnerable
forky
1:10.1.2+ds-1
fixed
sid
1:10.1.2+ds-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qemu
questing
needed
plucky
needed
oracular
ignored
noble
needed
jammy
needed
focal
needed
bionic
needed
xenial
needed
trusty
needed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2024-8354
https://bugzilla.redhat.com/show_bug.cgi?id=2313497
https://security.netapp.com/advisory/ntap-20241011-0008/