Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
02 / AFFECTED SOFTWARE
Affected packages
267 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
05 / REFERENCES
Further evidence
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/security/cve/CVE-2024-3447
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813
- https://bugzilla.redhat.com/show_bug.cgi?id=2274123
- https://cert-portal.siemens.com/productcert/html/ssa-577017.html
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3447.json
- https://gitlab.com/qemu-project/qemu
- https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-3447
- https://patchew.org/QEMU/[email protected]/
- https://security.netapp.com/advisory/ntap-20250425-0005/