CVE-2024-8354

Qemu-kvm: usb: assertion failure in usb_ep_get()

State: Published
Severity: 5.5 Medium
Published: Sep 19, 2024
Updated: Nov 8, 2025
Reserved: Aug 30, 2024

Description

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-617 Reachable Assertion

Affected Products

Product	Versions
qemu
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 8 Advanced VirtualizationRed Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2024-8354vdb-entry
RHBZ#2313497issue-tracking
https://security.netapp.com/advisory/ntap-20241011-0008/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.