{"api_version":"1","generated_at":"2026-05-13T02:10:56+00:00","cve":"CVE-2024-3447","urls":{"html":"https://cve.report/CVE-2024-3447","api":"https://cve.report/api/cve/CVE-2024-3447.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-3447","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-3447"},"summary":{"title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()","description":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of  `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","state":"PUBLISHED","assigner":"fedora","published_at":"2024-11-14 12:15:17","updated_at":"2026-05-12 12:16:57"},"problem_types":["CWE-122","CWE-122 Heap-based Buffer Overflow"],"metrics":[{"version":"3.1","source":"patrick@puiterwijk.org","type":"Secondary","score":"6","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","baseScore":6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274123","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2274123","refsource":"patrick@puiterwijk.org","tags":["Issue Tracking","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2024-3447","name":"https://access.redhat.com/security/cve/CVE-2024-3447","refsource":"patrick@puiterwijk.org","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-577017.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-577017.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://security.netapp.com/advisory/ntap-20250425-0005/","name":"https://security.netapp.com/advisory/ntap-20250425-0005/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813","name":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813","refsource":"patrick@puiterwijk.org","tags":["Exploit","Issue Tracking"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html","name":"https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/","name":"https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/","refsource":"patrick@puiterwijk.org","tags":["Broken Link"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3447","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3447","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8 Advanced Virtualization","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX MX5000","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX MX5000RE","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1400","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1500","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1501","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1510","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1511","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1512","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1524","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX1536","version":"affected V2.17.1 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"RUGGEDCOM ROX RX5000","version":"affected V2.17.1 custom","platforms":[]}],"timeline":[{"source":"CNA","time":"2024-04-09T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2024-04-04T00:00:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Chuhong Yuan for reporting this issue.","lang":"en"}],"nvd_cpes":[{"cve_year":"2024","cve_id":"3447","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"qemu","cpe5":"qemu","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2024-3447","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-11-14T18:53:42.574300Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-11-14T19:32:53.874Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2025-11-03T19:29:52.539Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://security.netapp.com/advisory/ntap-20250425-0005/"},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html"}],"title":"CVE Program Container"},{"affected":[{"defaultStatus":"unknown","product":"RUGGEDCOM ROX MX5000","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX MX5000RE","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1400","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1500","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1501","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1510","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1511","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1512","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1524","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX1536","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"RUGGEDCOM ROX RX5000","vendor":"Siemens","versions":[{"lessThan":"V2.17.1","status":"affected","version":"0","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T11:30:37.130Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-577017.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"collectionURL":"https://gitlab.com/qemu-project/qemu","defaultStatus":"unaffected","packageName":"qemu","versions":[{"lessThan":"9.0.0","status":"affected","version":"1.5.0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"qemu-kvm","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"qemu-kvm","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"qemu-kvm-ma","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"virt:rhel/qemu-kvm","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:advanced_virtualization:8::el8"],"defaultStatus":"unaffected","packageName":"virt:av/qemu-kvm","product":"Red Hat Enterprise Linux 8 Advanced Virtualization","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"qemu-kvm","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"credits":[{"lang":"en","value":"Red Hat would like to thank Chuhong Yuan for reporting this issue."}],"datePublic":"2024-04-04T00:00:00.000Z","descriptions":[{"lang":"en","value":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of  `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2024-11-14T12:10:36.880Z","orgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","shortName":"fedora"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-3447"},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813"},{"name":"RHBZ#2274123","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274123"},{"url":"https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/"}],"timeline":[{"lang":"en","time":"2024-04-09T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-04-04T00:00:00.000Z","value":"Made public."}],"title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()","x_redhatCweChain":"CWE-122: Heap-based Buffer Overflow"}},"cveMetadata":{"assignerOrgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","assignerShortName":"fedora","cveId":"CVE-2024-3447","datePublished":"2024-11-14T12:10:36.880Z","dateReserved":"2024-04-08T07:52:52.103Z","dateUpdated":"2026-05-12T11:30:37.130Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-11-14 12:15:17","lastModifiedDate":"2026-05-12 12:16:57","problem_types":["CWE-122","CWE-122 Heap-based Buffer Overflow"],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","baseScore":6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":4}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","matchCriteriaId":"0EAD89F2-2AEA-4655-B072-E12C2AD69711"},{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.2.3","matchCriteriaId":"59D5C13B-B7C8-4057-94E6-D5B29B0C745B"},{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:9.0.0:-:*:*:*:*:*:*","matchCriteriaId":"53B020E1-1339-4E3B-8CC3-7108309DF2F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:9.0.0:rc0:*:*:*:*:*:*","matchCriteriaId":"5E7620C7-95CD-4451-A485-69CF3752627B"},{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:9.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F8EBBE5A-0A6F-4F35-AA50-CA81B15F6BDC"},{"vulnerable":true,"criteria":"cpe:2.3:a:qemu:qemu:9.0.0:rc2:*:*:*:*:*:*","matchCriteriaId":"45846E0D-C683-4DAF-AE17-32CD8EB283F3"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*","matchCriteriaId":"4AFE5CAF-ACA7-4F82-BEC1-69562D75E66E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"3447","Ordinal":"1","Title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()","CVE":"CVE-2024-3447","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"3447","Ordinal":"1","NoteData":"A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of  `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.","Type":"Description","Title":"Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()"}]}}}