Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-3567: QEMU can crash when processing malformed network packet

CVE-2024-3567 · published 2 years ago

Summary

QEMU's network component may hit an internal error when it tries to calculate a checksum for a specially crafted, fragmented packet. This can cause the virtual machine manager to stop working, interrupting any services running on it. Update QEMU to the latest version provided by your Linux distribution to prevent this issue.

What to do

Update debian qemu to version 1:8.2.3+ds-1.
Update qemu qemu to version 8.2.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:13	debian	qemu	< 1:8.2.3+ds-1 Fix: upgrade to 1:8.2.3+ds-1
Debian:14	debian	qemu	< 1:8.2.3+ds-1 Fix: upgrade to 1:8.2.3+ds-1
–	qemu	qemu	>= 8.1.0, < 8.2.3 9.0.0 `cpe:2.3:a:qemu:qemu::::::::`
–	redhat	enterprise_linux	9.0 `cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*`

Original advisory text

Qemu-kvm: net: assertion failure in update_sctp_checksum()

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

References

https://security-tracker.debian.org/tracker/CVE-2024-3567 Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:4492 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-3567 Vendor Advisory
https://security.netapp.com/advisory/ntap-20240822-0007/ Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2274339 Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/2273 Third Party Advisory
https://access.redhat.com/downloads/content/package-browser/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3567.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-3567 Vendor Advisory
https://gitlab.com/qemu-project/qemu/ Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-617Reachable Assertion

Timeline

Published10 Apr 2024

Updated4 Nov 2026

First seen1 Sep 2026

Sources

DEBIAN-CVE-2024-3567 · OSV

CVE-2024-3567 · NVD

CVE-2024-3567 · OSV

Track software like this

Free during beta