PT-2024-39133 · Qemu+2 · Qemu+2

Xiao Lei + 2 · Published 2024-09-09 · Updated 2025-10-02 · CVE-2024-8612

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: QEMU (affected versions not specified)

Description: A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue push as set in virtio scsi complete req, virtio blk req complete, and virtio crypto req complete could be larger than the true size of the data sent to the guest. This may lead to an information leak due to uninitialized data in the bounce.buffer. Attackers may crash the system or execute code.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

AZL-60151

AZL-60910

BDU:2025-06254

CVE-2024-8612

MGASA-2024-0387

OESA-2024-2267

OPENSUSE-SU-2024:14411-1

OPENSUSE-SU-2024_3948-1

OPENSUSE-SU-2024_4094-1

OPENSUSE-SU-2024_4304-1

OPENSUSE-SU-2025_0692-1

SUSE-SU-2024:3744-1

SUSE-SU-2024:3948-1

SUSE-SU-2024:4094-1

SUSE-SU-2024:4304-1

SUSE-SU-2025:0692-1

SUSE-SU-2025:20076-1

Affected Products

Debian

Qemu

Suse

References · 61

• https://bdu.fstec.ru/vul/2025-06254 · Security Note
• https://osv.dev/vulnerability/AZL-60151 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2267 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-8612 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14411-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0692-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-8612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8612 · Security Note
• https://ubuntu.com/security/CVE-2024-8612 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:4304-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60910 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-8612 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:4094-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20076-1 · Vendor Advisory