« List of all CVEs

CVE-2024-3567

Qemu-kvm: net: assertion failure in update_sctp_checksum()

Published: 4/10/2024 Last updated: 11/8/2025 Reserved: 4/10/2024

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 5.5 Medium CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Opam packages affected (2)

conf-qemu-img nbd-tool

Products affected (11)

Product Vendor Version
>= 8.1.12
n/a
Red Hat Enterprise Linux 6 Red Hat 7 for 32-bit Systems Service Pack 1
Red Hat Enterprise Linux 7 Red Hat >= 8.1.2
Red Hat Enterprise Linux 9 Red Hat <= 12.2.13
Red Hat Enterprise Linux 9 Red Hat n/a
Red Hat Enterprise Linux 7 Red Hat < 115.0.5790.98
Red Hat Enterprise Linux 7 Red Hat 7 for x64-based Systems Service Pack 1
Red Hat Enterprise Linux 8 Advanced Virtualization Red Hat n/a
Red Hat Enterprise Linux 8 Advanced Virtualization Red Hat >= 8.1.3
Red Hat Enterprise Linux 8 Red Hat n/a

References (16)