Bug 2274123 (CVE-2024-3447)

Summary: CVE-2024-3447 QEMU: sdhci: heap buffer overflow in sdhci_write_dataport()
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ailan, ddepaula, jen, jferlan, jmaloy, kkiwi, knoel, mrezanin, mst, nilal, pbonzini, ymankad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2274124    
Bug Blocks: 2211418    

Description Mauro Matteo Cascella 2024-04-09 09:04:44 UTC 
A heap based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

Upstream patch:
https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/

oss-fuzz bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813
Comment 1 Mauro Matteo Cascella 2024-04-09 09:05:05 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2274124]
Comment 2 Mauro Matteo Cascella 2024-04-09 16:55:22 UTC 
Patch v2:
https://patchew.org/QEMU/20240409145524.27913-1-philmd@linaro.org/