PT-2024-1923 · Qemu+6 · Qemu+6
Published
2024-02-14
·
Updated
2025-05-07
·
CVE-2024-26328
CVSS v3.1
6.0
Medium
| Vector | AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
QEMU versions 7.1.0 through 8.2.1
Description
The issue is related to a buffer overflow in the dynamic memory of the QEMU hardware emulator, specifically in the
register vfs() function (hw/pci/pcie sriov.c). This function does not set NumVFs to PCI SRIOV TOTAL VF, leading to mishandled interaction with hw/nvme/ctrl.c. Exploitation of this issue may allow an attacker to cause a denial of service. There have been reports of offensive activities targeting QEMU.Recommendations
For QEMU versions 7.1.0 through 8.2.1, consider disabling the
register vfs() function in hw/pci/pcie sriov.c as a temporary workaround until a patch is available. Restrict access to the hw/nvme/ctrl.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Qemu
Red Os
Suse
Ubuntu