CVE-2024-24474
Publication date 20 February 2024
Last updated 13 August 2024
Ubuntu priority
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| qemu | 24.04 LTS noble |
Not affected
|
| 22.04 LTS jammy |
Fixed 1:6.2+dfsg-2ubuntu6.22
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
References
Related Ubuntu Security Notices (USN)
- USN-6954-1
- QEMU vulnerabilities
- 13 August 2024