CVE-2024-26328: Medium severity Qemu Qemu vulnerability
An issue was discovered in QEMU 7.1.0 through 8.2.1. registervfs in hw/pci/pciesriov.c does not set NumVFs to PCISRIOVTOTALVF, and thus interaction with hw/nvme/ctrl.c is mishandled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u6 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:8.2.3+ds-1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.13+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.1.2+ds-3Fixed in 1:11.1.3+ds-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26328?
The severity of CVE-2024-26328 is classified as high due to improper handling of NumVFs in QEMU.
How do I fix CVE-2024-26328?
To fix CVE-2024-26328, upgrade to one of the fixed versions of QEMU provided by Debian.
Which versions of QEMU are affected by CVE-2024-26328?
QEMU versions 7.1.0 through 8.2.1 are affected by CVE-2024-26328.
What impact does CVE-2024-26328 have on QEMU users?
CVE-2024-26328 can lead to mishandling of PCI SR-IOV virtual functions, impacting performance and stability.
Is CVE-2024-26328 remotely exploitable?
Yes, CVE-2024-26328 can be exploited remotely under certain conditions, making it a significant vulnerability.