CVE-2024-26328: Medium severity Qemu Qemu vulnerability
An issue was discovered in QEMU 7.1.0 through 8.2.1. registervfs in hw/pci/pciesriov.c does not set NumVFs to PCISRIOVTOTALVF, and thus interaction with hw/nvme/ctrl.c is mishandled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u7Fixed in 1:9.0.2+ds-2Fixed in 1:9.1.0+ds-3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26328?
The severity of CVE-2024-26328 is classified as high due to improper handling of NumVFs in QEMU.
How do I fix CVE-2024-26328?
To fix CVE-2024-26328, upgrade to one of the fixed versions of QEMU provided by Debian.
Which versions of QEMU are affected by CVE-2024-26328?
QEMU versions 7.1.0 through 8.2.1 are affected by CVE-2024-26328.
What impact does CVE-2024-26328 have on QEMU users?
CVE-2024-26328 can lead to mishandling of PCI SR-IOV virtual functions, impacting performance and stability.
Is CVE-2024-26328 remotely exploitable?
Yes, CVE-2024-26328 can be exploited remotely under certain conditions, making it a significant vulnerability.