{"id":"CVE-2024-26327","aliases":["ALSA-2024:9136","AZL-61716","BELL-CVE-2024-26327","CLSA-2026-1778125769","DEBIAN-CVE-2024-26327","EUVD-2024-23596","GHSA-7m48-vw34-vw84","MGASA-2024-0387","RHSA-2024:9136","RLSA-2024:9136","SUSE-SU-2024:1103-1","UBUNTU-CVE-2024-26327","USN-6977-1"],"status":"published","title":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c...","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00596,"percentile":0.48788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2024-02-19T00:00:00Z","modified":"2026-11-02T12:01:40Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-16"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"qemu","fixed_in":["9.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-16"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"},{"fixed":"9.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u6"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1","1:7.2+dfsg-7+deb12u3","1:7.2+dfsg-7+deb12u4","1:7.2+dfsg-7+deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:9.0.0-10.el9_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:9.0.0-10.el9_5.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.2"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.2"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1"],"bundled":2}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/","tags":["x_transferred","Patch","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0010/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26327","tags":["web","advisory"]},{"url":"https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com"},{"url":"https://security.netapp.com/advisory/ntap-20240419-0010"},{"url":"https://github.com/advisories/GHSA-7m48-vw34-vw84"},{"url":"https://access.redhat.com/errata/RHSA-2024:9136","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26327","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3446","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7409","tags":["report"]},{"url":"https://bugzilla.redhat.com/2264844","tags":["report"]},{"url":"https://bugzilla.redhat.com/2274211","tags":["report"]},{"url":"https://bugzilla.redhat.com/2302487","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9136.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-26327","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-55","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778125769.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26327.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-26327","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302487","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-17719","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-21695","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-24024","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-28073","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-28686","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-28813","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-30362","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-33440","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-33889","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-34618","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-34621","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-34945","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-36159","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-38697","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-40708","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-42411","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-50000","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9136.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3446","tags":["advisory"]},{"url":"https://patchew.org/QEMU/20240409105537.18308-1-philmd@linaro.org/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7409","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26327","tags":["advisory","report"]},{"url":"https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4@daynix.com/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9136","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241103-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205316","tags":["report"]},{"url":"https://bugzilla.suse.com/1209554","tags":["report"]},{"url":"https://bugzilla.suse.com/1218484","tags":["report"]},{"url":"https://bugzilla.suse.com/1220062","tags":["report"]},{"url":"https://bugzilla.suse.com/1220065","tags":["report"]},{"url":"https://bugzilla.suse.com/1220134","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26328","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-26327","tags":["report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2024-02/msg03387.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6977-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-26328","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-26327","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T00:00:00Z","modified":"2024-08-02T00:07:19.139Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-23596","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T00:00:00Z","modified":"2024-08-02T00:07:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:50:27.742015Z"}],"ghsa":[{"id":"GHSA-7m48-vw34-vw84","title":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c...","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T06:30:33Z","modified":"2025-05-07T12:30:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T15:02:10.218491Z"}],"nvd":[{"id":"CVE-2024-26327","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T05:15:22.527Z","modified":"2026-06-17T07:17:36.877Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787","CWE-122"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"AZL-61716","title":"CVE-2024-26327 affecting package qemu for versions less than 8.2.0-16","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T05:15:22Z","modified":"2026-04-21T04:56:49.813223Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2024-26327","status":"published","published":"2024-02-20T05:56:11.27759Z","modified":"2026-01-26T09:36:02.108618Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-26327","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T00:00:00Z","modified":"2026-10-28T02:30:37.408018263Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-26327","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T05:15:22.527Z","modified":"2026-11-02T12:01:40.428333779Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"RHSA-2024:9136","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-11-15T18:46:28Z","modified":"2026-10-09T10:12:51Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-26327","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations.","status":"published","published":"2024-02-19T05:15:00Z","modified":"2026-02-04T03:14:37.656551Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"ALSA-2024:9136","title":"Moderate: qemu-kvm security update","description":"Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.  \n\nSecurity Fix(es):  \n\n  * QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow (CVE-2024-26327)\n  * QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)\n  * QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:52.156044467Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2026-1778125769","title":"qemu-kvm: Fix of 3 CVEs","description":"- CVE-2023-3019: net: improper synchronization in net device backends\n- CVE-2023-42467: scsi-disk: division by zero in scsi_disk_emulate_mode_select\n- CVE-2024-26327: pcie_sriov: NumVFs validation buffer overflow","status":"published","published":"2026-05-07T03:49:36Z","modified":"2026-06-01T00:32:29.460726549Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"RLSA-2024:9136","title":"Moderate: qemu-kvm security update","description":"Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow (CVE-2024-26327)\n\n* QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)\n\n* QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2026-02-05T04:45:08.750632Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:1103-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-26327: Fixed buffer overflow via invalid SR/IOV NumVFs value (bsc#1220062).\n- CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134).\n- CVE-2023-6693: Fixed stack buffer overflow in virtio_net_flush_tx() (bsc#1218484).\n- CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554).\n- CVE-2024-26328: Fixed invalid NumVFs value handled in NVME SR/IOV implementation (bsc#1220065).\n\nThe following non-security bug was fixed:\n\n- Removing in-use mediated device should fail with error message instead of hang (bsc#1205316).\n","status":"published","published":"2024-04-03T12:11:07Z","modified":"2026-02-04T04:40:44.89986Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6977-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU did not properly handle certain memory\noperations, which could result in a buffer overflow. An attacker could\npotentially use this issue to cause a denial of service. (CVE-2024-26327)\n\nIt was discovered that QEMU did not properly handle certain memory\noperations, which could result in an out-of-bounds memory access. An\nattacker could potentially use this issue to cause a denial of service.\n(CVE-2024-26328)\n","status":"published","published":"2024-08-22T04:04:17Z","modified":"2026-02-10T04:45:04Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}