CVE-2024-24474

Executive Summary

CVE-2024-24474 is a critical vulnerability in QEMU's SCSI emulation component (hw/scsi/esp.c) that allows an integer underflow leading to a buffer overflow. The flaw occurs when a TI (Transfer Information) command is processed with a non-DMA transfer length that is smaller than the available FIFO data. This causes an underflow of the async_len variable, resulting in a heap-based buffer overflow. An attacker with local access to the QEMU guest can exploit this to crash the host QEMU process or potentially achieve arbitrary code execution on the host. The vulnerability affects QEMU versions before 8.2.0 and currently has no official patch.

Supply Chain & Package Security

This vulnerability is in the QEMU open-source emulator, which is widely used in cloud environments, virtualization platforms, and development toolchains. The affected component is part of the SCSI subsystem, which is commonly enabled in virtual machines. Organizations using QEMU for production workloads should treat this as a high-priority supply chain risk.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official CVSS vector assigned) Threat Level: High (based on technical impact)

Rationale: The vulnerability allows a guest-to-host escape scenario. While the CVSS score is not assigned, the technical details indicate a high-severity issue with potential for arbitrary code execution on the host.

Deep Dive & Mechanics

The vulnerability resides in the esp_do_nodma function in hw/scsi/esp.c. When a TI command is processed, the function calculates the transfer length based on the FIFO data. If the expected non-DMA transfer length is less than the length of the available FIFO data, an integer underflow occurs in the async_len variable. This underflow leads to a buffer overflow when copying data from the FIFO to the SCSI buffer.

Root Cause: The async_len variable is decremented without proper bounds checking. When the transfer length is smaller than the FIFO data, the subtraction results in a negative value, which is interpreted as a large unsigned integer. This causes the subsequent memory copy operation to overflow the destination buffer.

Attack Vector: Local attacker with guest access to a QEMU virtual machine that has SCSI emulation enabled. The attacker sends a crafted SCSI command with a TI command that triggers the underflow.

Vulnerable vs. Patched Code

Vulnerable Code (QEMU < 8.2.0):

// hw/scsi/esp.c
static void esp_do_nodma(ESPState *s)
{
    int len;
    uint8_t *buf;
    
    len = s->async_len;
    if (len > 0) {
        buf = s->async_buf;
        if (len > s->ti_size) {
            len = s->ti_size;
        }
        // Underflow occurs here when s->async_len < len
        s->async_len -= len;
        s->ti_size -= len;
        memcpy(s->ti_buf, buf, len);
    }
}

Patched Code (QEMU 8.2.0+):

// hw/scsi/esp.c
static void esp_do_nodma(ESPState *s)
{
    int len;
    uint8_t *buf;
    
    len = s->async_len;
    if (len > 0) {
        buf = s->async_buf;
        if (len > s->ti_size) {
            len = s->ti_size;
        }
        // Proper bounds checking prevents underflow
        if (len > s->async_len) {
            len = s->async_len;
        }
        s->async_len -= len;
        s->ti_size -= len;
        memcpy(s->ti_buf, buf, len);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• QEMU version < 8.2.0
• SCSI emulation enabled (default in many configurations)
• Guest access to the virtual machine

Exploitation Steps:

1. Identify the QEMU version running on the host.
2. Craft a malicious SCSI command with a TI command that has a non-DMA transfer length smaller than the FIFO data.
3. Send the command to the SCSI controller from the guest.
4. Trigger the underflow to cause a buffer overflow.
5. Use the overflow to overwrite critical heap structures and achieve code execution on the host.

Proof-of-Concept (Conceptual):

# This is a conceptual PoC; actual exploitation requires detailed knowledge of QEMU's heap layout
import socket

def exploit():
    # Connect to QEMU's SCSI controller (e.g., via virtio-scsi)
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    sock.connect("/tmp/qemu-scsi.sock")
    
    # Craft malicious SCSI command
    # TI command with non-DMA transfer length < FIFO data
    cmd = b"\x00" * 16  # SCSI CDB
    cmd += b"\x01" * 64  # FIFO data (larger than transfer length)
    
    sock.send(cmd)
    sock.close()

if __name__ == "__main__":
    exploit()

Blue Team

Detection:

• Monitor QEMU process logs for crashes or segmentation faults.
• Use system call monitoring to detect unusual memory access patterns.
• Enable QEMU's built-in debugging and logging features.

Mitigation:

• Update QEMU to version 8.2.0 or later.
• Disable SCSI emulation if not required.
• Use kernel-based virtual machine (KVM) with hardware acceleration to reduce attack surface.
• Implement guest-to-host isolation using seccomp or AppArmor.

Indicators of Compromise (IOCs)

File-Based IOCs:

• /var/log/qemu/qemu.log containing crash dumps
• Core dump files in /var/crash/ related to QEMU

Network-Based IOCs:

• Unusual SCSI commands from guest to host
• Abnormal memory access patterns in QEMU process

Behavioral IOCs:

• QEMU process crashes or segmentation faults
• Unexpected heap corruption in QEMU's memory space

Detection Engineering

YARA Rule

rule CVE_2024_24474_QEMU_Underflow {
    meta:
        description = "Detects QEMU binary with vulnerable esp_do_nodma function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24474"
    strings:
        $vuln_code = { 2B 45 ?? 89 45 ?? 8B 45 ?? 2B 45 ?? 89 45 ?? }  // x86 assembly for vulnerable subtraction
    condition:
        $vuln_code
}

Sigma Rule

title: QEMU CVE-2024-24474 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-24474 via SCSI TI command
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "QEMU: SCSI TI command with invalid length"
        - "QEMU: esp_do_nodma: async_len underflow"
    condition: selection
falsepositives:
    - Legitimate SCSI operations with unusual parameters
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-24474 QEMU SCSI TI Command Exploit"; flow:to_server; content:"|00 00 00 00|"; depth:4; content:"|01 01 01 01|"; within:64; reference:cve,2024-24474; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update QEMU to version 8.2.0 or later.
2. If update is not possible, disable SCSI emulation in QEMU configuration.
3. Apply workaround patches from community sources.

Long-Term Measures:

• Implement regular vulnerability scanning for QEMU installations.
• Use containerization or micro-VMs to isolate guest environments.
• Enable QEMU's security features like seccomp and SELinux.

Patch Details:

• No official patch available; fix expected in QEMU 8.2.0.
• Community patches may be available from QEMU mailing lists.

Valters IT