CVE-2024-24474: QEMU Buffer Overflow Vulnerability

CVE-2024-24474 Overview

CVE-2024-24474 is an integer underflow vulnerability in QEMU versions prior to 8.2.0 that leads to a heap buffer overflow. The flaw resides in the esp_do_nodma function in hw/scsi/esp.c, which handles the emulated AMD ESP SCSI controller. When a Target/Initiator (TI) command is issued with an expected non-DMA transfer length that is less than the length of the available FIFO data, the async_len variable underflows. Authenticated guest users can trigger the condition to corrupt memory in the QEMU process on the host, potentially breaking out of the guest boundary [CWE-120].

Critical Impact
Guest-to-host memory corruption in the QEMU process, enabling loss of confidentiality, integrity, and availability across virtualized workloads.

Affected Products

QEMU versions prior to 8.2.0
Distributions bundling vulnerable QEMU builds with the ESP SCSI device model
NetApp products embedding affected QEMU components (per NetApp advisory ntap-20240510-0012)

Discovery Timeline

2024-02-20 - CVE-2024-24474 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24474

Vulnerability Analysis

The vulnerability affects the emulated AMD 53C9x ESP SCSI controller in QEMU. During non-DMA transfers, esp_do_nodma moves data between the FIFO and an asynchronous buffer tracked by async_len. The original code selected the number of bytes to pop from the FIFO based only on the FIFO's used size, without validating it against async_len. When the FIFO contains more bytes than the transfer expects, the subtraction s->async_len -= len wraps around because len exceeds async_len.

The resulting underflow turns async_len into a very large unsigned value. Subsequent operations that trust this length write past the boundaries of the destination buffer, producing a heap buffer overflow inside the QEMU host process. A malicious guest with the ability to issue SCSI commands to the emulated ESP controller can drive this condition deterministically.

Root Cause

The root cause is missing bounds validation between the FIFO byte count and the expected transfer length before performing arithmetic on async_len. The code trusted guest-influenced FIFO state rather than clamping transfers to the remaining asynchronous buffer size.

Attack Vector

Exploitation requires low-privilege access inside a guest that can interact with the emulated ESP SCSI device. The attacker crafts a TI command whose expected non-DMA transfer length is smaller than the current FIFO occupancy, triggering the underflow and out-of-bounds write in the QEMU process.

// Patch: hw/scsi/esp.c - restrict non-DMA transfer length to available data
    if (to_device) {
-        len = MIN(fifo8_num_used(&s->fifo), ESP_FIFO_SZ);
+        len = MIN(s->async_len, ESP_FIFO_SZ);
+        len = MIN(len, fifo8_num_used(&s->fifo));
        esp_fifo_pop_buf(&s->fifo, s->async_buf, len);
        s->async_buf += len;
        s->async_len -= len;

The fix clamps len to s->async_len before popping from the FIFO, preventing the underflow. Source: QEMU commit 77668e4b9bca03a856c27ba899a2513ddf52bb52.

Detection Methods for CVE-2024-24474

Indicators of Compromise

Unexpected QEMU process crashes or SIGSEGV signals on hypervisor hosts running guests configured with the ESP SCSI controller.
Kernel or hypervisor logs showing memory corruption or aborts originating from QEMU worker threads handling SCSI I/O.
Guest workloads issuing unusual SCSI TI commands with mismatched non-DMA transfer lengths against the emulated ESP device.

Detection Strategies

Inventory hypervisor hosts and identify QEMU builds older than 8.2.0 that expose the esp or am53c974 SCSI controller to guests.
Instrument QEMU with AddressSanitizer in test environments to catch heap overflows in esp_do_nodma before deploying updated builds.
Correlate guest VM SCSI activity with host-side QEMU stability events to identify guests attempting to trigger the flaw.

Monitoring Recommendations

Forward hypervisor host logs, including libvirtd and QEMU stderr, to a centralized platform for anomaly review.
Alert on repeated QEMU process restarts tied to a specific guest, which may indicate exploitation attempts against the ESP device model.
Track configuration drift that reintroduces the ESP SCSI controller into VM definitions after remediation.

How to Mitigate CVE-2024-24474

Immediate Actions Required

Upgrade QEMU to version 8.2.0 or later on all hypervisor hosts running untrusted guests.
Apply distribution-provided backports that include commit 77668e4b9bca03a856c27ba899a2513ddf52bb52 when upgrading the full QEMU release is not feasible.
Review NetApp advisory ntap-20240510-0012 and apply vendor-supplied updates for affected appliances.

Patch Information

The upstream fix is available in the QEMU commit restricting non-DMA transfer length to available data and is included in QEMU 8.2.0. Additional context is available in the QEMU project GitLab issue 1810 and the NetApp Security Advisory NTAP-20240510-0012.

Workarounds

Reconfigure guests to use virtio-scsi or lsi SCSI controllers instead of the emulated ESP (am53c974) device.
Restrict which users and management APIs can attach the ESP SCSI controller to VM definitions.
Isolate multi-tenant guests on hosts patched to QEMU 8.2.0 or later before permitting untrusted workloads.

bash

# Verify QEMU version and audit VM definitions for the vulnerable ESP controller
qemu-system-x86_64 --version

# List running VMs and check for the am53c974 (ESP) SCSI controller
for vm in $(virsh list --name); do
  virsh dumpxml "$vm" | grep -E 'am53c974|esp' && echo "[!] $vm uses ESP SCSI - reconfigure or patch host"
done