2264844 – (CVE-2024-26327) CVE-2024-26327 QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow

Bug 2264844 (CVE-2024-26327) - CVE-2024-26327 QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow

Summary: CVE-2024-26327 QEMU: SR-IOV: improper validation of NumVFs leads to buffer ov...

Keywords:
Status:	NEW
Alias:	CVE-2024-26327
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2264845
Blocks:	2264850
TreeView+	depends on / blocked

Reported:	2024-02-19 09:26 UTC by Mauro Matteo Cascella
Modified:	2024-11-12 08:56 UTC (History)
CC List:	12 users (show)
Fixed In Version:	qemu-kvm 9.0.0
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2024:9136	0	None	None	None	2024-11-12 08:56:02 UTC

Description Mauro Matteo Cascella 2024-02-19 09:26:28 UTC

An issue was discovered in QEMU 7.1.0 through 8.2.1. The register_vfs() function in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.

Reference:
https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4@daynix.com/

Comment 1 Mauro Matteo Cascella 2024-02-19 09:37:11 UTC

Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2264845]

Comment 3 Mauro Matteo Cascella 2024-05-31 11:14:10 UTC

Upstream commit:
https://gitlab.com/qemu-project/qemu/-/commit/6081b4243cd64dff1b2cf5b0c215c71e9d7e753b

Comment 4 errata-xmlrpc 2024-11-12 08:56:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9136 https://access.redhat.com/errata/RHSA-2024:9136

Note You need to log in before you can comment on or make changes to this bug.