CVE-2024-26328 is a medium-severity vulnerability affecting QEMU versions 7.1.0 through 8.2.1, stemming from an improper initialization of NumVFs in the register_vfs function which leads to mishandled interactions with the NVMe controller. This local vulnerability (CVSS 6.0) requires high privileges and has a high impact on availability, potentially leading to a denial of service. There is currently no public exploit code available, nor is there any evidence of active exploitation or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.1.0, <= 8.2.1CPE matchmatch criteria | cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
QEMU: NVMe: out-of-bounds memory access in nvme_sriov_pre_write_ctrl()
Feb 19, 2024An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.
Feb 13, 2024