CVE-2024-7409

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

References

Affected packages

Debian:11 / qemu

Package

Name: qemu
Purl: pkg:deb/debian/qemu?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:5.2+dfsg-11+deb11u5

Affected versions

1:5.*

1:5.2+dfsg-11

1:5.2+dfsg-11+deb11u1

1:5.2+dfsg-11+deb11u2

1:5.2+dfsg-11+deb11u3

1:5.2+dfsg-11+deb11u4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / qemu

Package

Name: qemu
Purl: pkg:deb/debian/qemu?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:7.2+dfsg-7+deb12u8

Affected versions

1:7.*

1:7.2+dfsg-7

1:7.2+dfsg-7+deb12u1

1:7.2+dfsg-7+deb12u2~bpo11+1

1:7.2+dfsg-7+deb12u2

1:7.2+dfsg-7+deb12u3

1:7.2+dfsg-7+deb12u4

1:7.2+dfsg-7+deb12u5

1:7.2+dfsg-7+deb12u6

1:7.2+dfsg-7+deb12u7

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / qemu

Package

Name: qemu
Purl: pkg:deb/debian/qemu?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.0.2+ds-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / qemu

Package

Name: qemu
Purl: pkg:deb/debian/qemu?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.0.2+ds-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}