CVE-2024-3567

MEDIUM EPSS 35.6%

Published Apr 10, 20242y ago · Modified Jun 17, 20261w ago

5.5 CVSS 3.1

Medium

Published Apr 10, 2024 2y ago

Last Modified Jun 17, 2026 1w ago

Description

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

35.6% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-617

Affected Products 5

Vendor	Product	Version	Range
qemu	qemu	*	≥8.1.0 – <8.2.3
qemu	qemu	9.0.0	any
qemu	qemu	9.0.0	any
qemu	qemu	9.0.0	any
redhat	enterprise_linux	9.0	any

References 5

access.redhat.com https://access.redhat.com/errata/RHSA-2025:4492
access.redhat.com https://access.redhat.com/security/cve/CVE-2024-3567

Vendor Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2274339

Issue Tracking
gitlab.com https://gitlab.com/qemu-project/qemu/-/issues/2273

ExploitIssue Tracking
security.netapp.com https://security.netapp.com/advisory/ntap-20240822-0007/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.