---
id: CVE-2024-8354
title: 'Qemu-kvm: usb: assertion failure in usb_ep_get()'
summary: >-
  A flaw was found in QEMU. An assertion failure was present in the usb_ep_get()
  function in hw/net/core.c when trying to get the USB endpoint from a USB
  device. This flaw may allow a malicious unprivileged guest user to crash the
  QEMU pro…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-617
vendor: Red Hat
product: qemu
affected:
  - qemu (all versions)
  - qemu-kvm (all versions)
  - qemu-kvm
  - qemu-kvm
  - qemu-kvm-ma
  - 'virt:rhel/qemu-kvm (all versions)'
  - 'virt:av/qemu-kvm (all versions)'
  - qemu-kvm (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-19T13:38:43.642114Z'
published: '2024-09-19'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T14:57:24.019Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-8354'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2024-8354'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2313497'
    label: RHBZ#2313497
tags:
  - cve.org
epss: 0.00286
epssPercentile: 0.21261
ingestedAt: '2026-11-06T15:54:04.092Z'
---

## Overview

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

## Affected

- `qemu (all versions)`
- `qemu-kvm (all versions)`
- `qemu-kvm`
- `qemu-kvm`
- `qemu-kvm-ma`
- `virt:rhel/qemu-kvm (all versions)`
- `virt:av/qemu-kvm (all versions)`
- `qemu-kvm (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.