CVE-2024-8354

What it actually does

An assertion failure in the usb_ep_get() function in hw/net/core.c causes the QEMU process to terminate when attempting to retrieve a USB endpoint from a device.

Why it matters to the business

Results in denial of service that can interrupt virtual machine hosting and operations; low exploitation probability with no known ransomware campaigns or CISA deadlines increases priority only for environments with untrusted guests.

How an attack unfolds

An unprivileged attacker inside a guest VM issues USB endpoint operations that hit the assertion in usb_ep_get(), terminating the QEMU process on the host and producing a denial of service.

How to fix it

Upgrade affected products to the listed fixed versions; for stdlib (Go) apply the update to 1.18.1 and verify QEMU builds or packages incorporate the corrected endpoint handling.

How to confirm the fix worked

Confirm the running QEMU binary or package version matches or exceeds the fixed release; test that USB device attachment no longer triggers the assertion under guest-controlled conditions.

Typical attack path

1. Obtain unprivileged access inside a guest virtual machine
2. Trigger USB endpoint retrieval via crafted device interaction
3. Trigger assertion failure to crash the QEMU host process

How to detect it

Review QEMU process crash logs and assertion failures referencing usb_ep_get or hw/net/core.c; correlate with guest VM activity involving USB device emulation.

What your security team should do

• Apply the specified fixed versions immediately on all hosts running affected QEMU builds
• Restrict untrusted guest access to USB passthrough until patches are deployed
• Monitor EPSS and KEV status for any future changes given the 752 days since publication