CVE-2024-26327 - Vulnerability Details - OpenCVE

An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Qemu	Qemu
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
qemu-kvm-17:9.0.0-10.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:9136	2024-11-12T00:00:00Z

References

Link	Providers
https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/
https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4@daynix.com/
https://nvd.nist.gov/vuln/detail/CVE-2024-26327
https://security.netapp.com/advisory/ntap-20240419-0010/
https://www.cve.org/CVERecord?id=CVE-2024-26327

History

Wed, 13 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-02-19T00:00:00

Updated: 2024-08-02T00:07:19.139Z

Reserved: 2024-02-19T00:00:00

Link: CVE-2024-26327

Vulnrichment

Updated: 2024-04-19T15:18:59.245Z

NVD

Status : Awaiting Analysis

Published: 2024-02-19T05:15:22.527

Modified: 2024-11-21T09:02:21.927

Link: CVE-2024-26327

Redhat

Severity : Moderate

Publid Date: 2024-02-19T00:00:00Z

Links: CVE-2024-26327 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-26327", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T00:07:19.139Z", "dateReserved": "2024-02-19T00:00:00", "datePublished": "2024-02-19T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-19T07:05:52.417171"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/"}, {"url": "https://security.netapp.com/advisory/ntap-20240419-0010/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-20T18:12:39.644035Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*"], "vendor": "qemu", "product": "qemu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:48:31.165Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.139Z"}, "title": "CVE Program Container", "references": [{"url": "https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240419-0010/", "tags": ["x_transferred"]}]}]}}

{"affected_release": [{"advisory": "RHSA-2024:9136", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "qemu-kvm-17:9.0.0-10.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow", "id": "2264844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264844"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-120", "details": ["An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.", "A flaw was found in the SR/IOV emulation support of QEMU. The register_vfs() function in hw/pci/pcie_sriov.c mishandled the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF (Virtual Function) implementations. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition."], "name": "CVE-2024-26327", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm-ma", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "virt:rhel/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:advanced_virtualization:8::el8", "fix_state": "Not affected", "package_name": "virt:av/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8 Advanced Virtualization"}], "public_date": "2024-02-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26327\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26327\nhttps://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4@daynix.com/"], "statement": "The `qemu-kvm` versions, as shipped with Red Hat Enterprise Linux 6, 7, 8 and RHEL Advanced Virtualization, are not affected by this CVE as they did not include Single Root I/O Virtualization (SR/IOV) support.", "threat_severity": "Moderate", "upstream_fix": "qemu-kvm 9.0.0"}