CVE-2024-8354

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

This CVE is rated as Low because unprivileged users are not able to craft USB Request Blocks (URBs). While they may be able to reach the assertion in usb_ep_get(), the vulnerability is considered unlikely to be exploited under normal circumstances.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.