CVE-2024-8354

MEDIUM EPSS 20.3%

Published Sep 19, 20241y ago · Modified Jun 17, 20261w ago

5.5 CVSS 3.1

Medium

Published Sep 19, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

20.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-617

Affected Products 6

Vendor	Product	Version	Range
qemu	qemu	*	any
redhat	enterprise_linux	6.0	any
redhat	enterprise_linux	7.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux	9.0	any

References 3

access.redhat.com https://access.redhat.com/security/cve/CVE-2024-8354

Vendor Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2313497

Issue Tracking
security.netapp.com https://security.netapp.com/advisory/ntap-20241011-0008/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.