CVE-2024-24474
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIF…
Published: 2024-02-20 · CVSS: 8.8 · CVSS 3.1
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7