CVE-2024-3447

What it actually does

Heap-based buffer overflow in QEMU SDHCI device emulation triggered when both s->data_count and s->fifo_buffer size are set to 0x200, causing out-of-bounds memory access from a guest.

Why it matters to the business

A compromised or malicious virtual machine can crash the host QEMU process, resulting in denial of service for all VMs on that host and potential operational disruption in virtualized environments.

How an attack unfolds

An attacker controlling a guest VM configures SDHCI registers to set data_count and fifo_buffer size to 0x200, then performs operations that trigger the out-of-bounds access, crashing the host QEMU process.

How to fix it

Update QEMU to the fixed commit c6fe0f315cfac9739c8d57ffa05c9c22d7ebd2cb; for Discourse instances also apply commit 0bd64788d2b4680c04fbef76314a24884d65fed9 if applicable in the environment.

How to confirm the fix worked

Confirm QEMU is running a version containing commit c6fe0f315cfac9739c8d57ffa05c9c22d7ebd2cb and test SDHCI emulation paths to ensure no crash occurs under the triggering conditions.

Typical attack path

1. Obtain control of a guest virtual machine
2. Manipulate SDHCI device state to set data_count and fifo_buffer size to 0x200
3. Issue SDHCI operations that cause out-of-bounds access
4. Crash the QEMU process on the host

How to detect it

Review QEMU process logs, core dumps, and system crash reports for SDHCI-related buffer handling errors or abrupt terminations on hosts.

What your security team should do

• Apply the listed fixed commits to QEMU immediately
• Isolate or restrict untrusted guest VMs pending updates
• Monitor host logs for QEMU process crashes
• Review virtualization infrastructure for exposure to guest-controlled devices