CVE-2024-26328

A flaw was found in the NVMe emulation support of QEMU. The register_vfs() function in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, causing the interaction with hw/nvme/ctrl.c to be mishandled. This issue could lead to out-of-bounds memory access in hw/nvme. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

The affected code path can only be reached if dev->exp.sriov_cap is set. For example, if QEMU is explicitly launched with the hw/nvme SR-IOV emulation enabled (parameter sriov_max_vfs is set). The emulation is exclusively used to emulate NVMe devices with SR-IOV capabilities for host software development purposes. Thus, the security impact of this CVE is Low.

The qemu-kvm versions, as shipped with Red Hat Enterprise Linux and RHEL Advanced Virtualization, are not affected by this flaw as they did not include support for NVMe emulation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.