CVE-2024-3567: Qemu-kvm: net: assertion failure in update_sctp_checksum()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-10 · updated 2026-06-17
Weakness: CWE-617

Description

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

Affected products

QEMU: from 8.1.0 before 8.2.3; 9.0.0-rc0, 9.0.0-rc1, 9.0.0-rc2 — fixed in 8.2.3
Red Hat Enterprise Linux: 9.0

How to fix

Upgrade to a fixed version: QEMU 8.2.3. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2025:4492
https://access.redhat.com/security/cve/CVE-2024-3567
https://bugzilla.redhat.com/show_bug.cgi?id=2274339
https://gitlab.com/qemu-project/qemu/-/issues/2273
https://access.redhat.com/security/cve/CVE-2024-3567
https://bugzilla.redhat.com/show_bug.cgi?id=2274339
https://gitlab.com/qemu-project/qemu/-/issues/2273
https://security.netapp.com/advisory/ntap-20240822-0007/

Get alerted when CVE-2024-3567 or the next vulnerability affects your stack