Buffer overflow in QEMU - CVE-2024-26327

Vulnerability identifier: #VU100251

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-26327

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to a boundary error within the register_vfs() function in hw/pci/pcie_sriov.c in VF implementations. A malicious guest can trigger memory corruption and execute arbitrary code on the system.

QEMU
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Server Applications Module
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Anolis OS
Ubuntu
qemu-ipxe
qemu-seabios
qemu-vgabios
qemu-hw-usb-redirect-debuginfo
qemu-hw-usb-host-debuginfo
qemu
qemu-audio-dbus-debuginfo
qemu-guest-agent-debuginfo
qemu-lang
qemu-block-iscsi-debuginfo
qemu-block-rbd-debuginfo
qemu-ui-spice-core-debuginfo
qemu-chardev-spice-debuginfo
qemu-hw-display-qxl
qemu-hw-display-qxl-debuginfo
qemu-ui-gtk
qemu-hw-usb-redirect
qemu-audio-dbus
qemu-ui-gtk-debuginfo
qemu-ui-spice-core
qemu-ui-spice-app
qemu-ui-opengl-debuginfo
qemu-audio-spice-debuginfo
qemu-ui-opengl
qemu-hw-display-virtio-vga
qemu-audio-spice
qemu-chardev-spice
qemu-block-rbd
qemu-tools
qemu-linux-user-debugsource
qemu-headless
qemu-tools-debuginfo
qemu-linux-user
qemu-linux-user-debuginfo
qemu-kvm
qemu-chardev-baum-debuginfo
qemu-ui-dbus
qemu-block-iscsi
qemu-chardev-baum
qemu-block-ssh
qemu-ui-curses-debuginfo
qemu-block-ssh-debuginfo
qemu-guest-agent
qemu-block-curl
qemu-ui-curses
qemu-hw-usb-host
qemu-ui-dbus-debuginfo
qemu-ksm
qemu-block-curl-debuginfo
qemu-SLOF
qemu-accel-qtest-debuginfo
qemu-vhost-user-gpu
qemu-block-nfs
qemu-audio-oss
qemu-ivshmem-tools-debuginfo
qemu-block-dmg-debuginfo
qemu-hw-usb-smartcard-debuginfo
qemu-audio-jack
qemu-audio-jack-debuginfo
qemu-extra
qemu-block-gluster-debuginfo
qemu-extra-debuginfo
qemu-hw-display-virtio-vga-debuginfo
qemu-debugsource
qemu-vhost-user-gpu-debuginfo
qemu-block-gluster
qemu-accel-qtest
qemu-hw-usb-smartcard
qemu-debuginfo
qemu-audio-oss-debuginfo
qemu-block-dmg
qemu-microvm
qemu-skiboot
qemu-ui-spice-app-debuginfo
qemu-ivshmem-tools
qemu-arm-debuginfo
qemu-block-nfs-debuginfo
qemu-arm
qemu-ppc-debuginfo
qemu-ppc
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-s390x-debuginfo
qemu-s390x
qemu-hw-s390x-virtio-gpu-ccw
qemu-hw-display-virtio-gpu-pci
qemu-hw-display-virtio-gpu
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-accel-tcg-x86-debuginfo
qemu-audio-alsa-debuginfo
qemu-audio-alsa
qemu-audio-pa
qemu-audio-pa-debuginfo
qemu-accel-tcg-x86
qemu-x86
qemu-x86-debuginfo
qemu-system-loongarch64-core
qemu-system-loongarch64
qemu-system-arm-core
qemu-system-arm
qemu-system-aarch64-core
qemu-system-aarch64
qemu-pr-helper
qemu-kvm-core
qemu-img
qemu-docs
qemu-device-usb-smartcard
qemu-device-usb-redirect
qemu-system-riscv
qemu-system-riscv-core
qemu-system-x86
qemu-system-x86-core
qemu-tests
qemu-ui-egl-headless
qemu-user
qemu-user-binfmt
qemu-device-display-virtio-vga-gl
qemu-device-usb-host
qemu-char-baum
qemu-char-spice
qemu-common
qemu-device-display-qxl
qemu-device-display-virtio-gpu
qemu-device-display-virtio-gpu-ccw
qemu-device-display-virtio-gpu-pci
qemu-device-display-virtio-vga
qemu-system-x86 (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-sgabios
qemu-kvm (Red Hat package)

Install updates from vendor's website.

QEMU - update to 8.2.3
qemu-ipxe - update to 1.0.0+-150500.49.12.1
qemu-seabios - update to 1.16.0_0_gd239552-150500.49.12.1
qemu-vgabios - update to 1.16.0_0_gd239552-150500.49.12.1
qemu-hw-usb-redirect-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-usb-host-debuginfo - update to 7.1.0-150500.49.12.1
qemu - update to 7.1.0-150500.49.12.1
qemu-audio-dbus-debuginfo - update to 7.1.0-150500.49.12.1
qemu-guest-agent-debuginfo - update to 7.1.0-150500.49.12.1
qemu-lang - update to 7.1.0-150500.49.12.1
qemu-block-iscsi-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-rbd-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-spice-core-debuginfo - update to 7.1.0-150500.49.12.1
qemu-chardev-spice-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-display-qxl - update to 7.1.0-150500.49.12.1
qemu-hw-display-qxl-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-gtk - update to 7.1.0-150500.49.12.1
qemu-hw-usb-redirect - update to 7.1.0-150500.49.12.1
qemu-audio-dbus - update to 7.1.0-150500.49.12.1
qemu-ui-gtk-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-spice-core - update to 7.1.0-150500.49.12.1
qemu-ui-spice-app - update to 7.1.0-150500.49.12.1
qemu-ui-opengl-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-spice-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-opengl - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-vga - update to 7.1.0-150500.49.12.1
qemu-audio-spice - update to 7.1.0-150500.49.12.1
qemu-chardev-spice - update to 7.1.0-150500.49.12.1
qemu-block-rbd - update to 7.1.0-150500.49.12.1
qemu-tools - update to 7.1.0-150500.49.12.1
qemu-linux-user-debugsource - update to 7.1.0-150500.49.12.1
qemu-headless - update to 7.1.0-150500.49.12.1
qemu-tools-debuginfo - update to 7.1.0-150500.49.12.1
qemu-linux-user - update to 7.1.0-150500.49.12.1
qemu-linux-user-debuginfo - update to 7.1.0-150500.49.12.1
qemu-kvm - update to 7.1.0-150500.49.12.1
qemu-chardev-baum-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ui-dbus - update to 7.1.0-150500.49.12.1
qemu-block-iscsi - update to 7.1.0-150500.49.12.1
qemu-chardev-baum - update to 7.1.0-150500.49.12.1
qemu-block-ssh - update to 7.1.0-150500.49.12.1
qemu-ui-curses-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-ssh-debuginfo - update to 7.1.0-150500.49.12.1
qemu-guest-agent - update to 7.1.0-150500.49.12.1
qemu-block-curl - update to 7.1.0-150500.49.12.1
qemu-ui-curses - update to 7.1.0-150500.49.12.1
qemu-hw-usb-host - update to 7.1.0-150500.49.12.1
qemu-ui-dbus-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ksm - update to 7.1.0-150500.49.12.1
qemu-block-curl-debuginfo - update to 7.1.0-150500.49.12.1
qemu-SLOF - update to 7.1.0-150500.49.12.1
qemu-accel-qtest-debuginfo - update to 7.1.0-150500.49.12.1
qemu-vhost-user-gpu - update to 7.1.0-150500.49.12.1
qemu-block-nfs - update to 7.1.0-150500.49.12.1
qemu-audio-oss - update to 7.1.0-150500.49.12.1
qemu-ivshmem-tools-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-dmg-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-usb-smartcard-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-jack - update to 7.1.0-150500.49.12.1
qemu-audio-jack-debuginfo - update to 7.1.0-150500.49.12.1
qemu-extra - update to 7.1.0-150500.49.12.1
qemu-block-gluster-debuginfo - update to 7.1.0-150500.49.12.1
qemu-extra-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-vga-debuginfo - update to 7.1.0-150500.49.12.1
qemu-debugsource - update to 7.1.0-150500.49.12.1
qemu-vhost-user-gpu-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-gluster - update to 7.1.0-150500.49.12.1
qemu-accel-qtest - update to 7.1.0-150500.49.12.1
qemu-hw-usb-smartcard - update to 7.1.0-150500.49.12.1
qemu-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-oss-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-dmg - update to 7.1.0-150500.49.12.1
qemu-microvm - update to 7.1.0-150500.49.12.1
qemu-skiboot - update to 7.1.0-150500.49.12.1
qemu-ui-spice-app-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ivshmem-tools - update to 7.1.0-150500.49.12.1
qemu-arm-debuginfo - update to 7.1.0-150500.49.12.1
qemu-block-nfs-debuginfo - update to 7.1.0-150500.49.12.1
qemu-arm - update to 7.1.0-150500.49.12.1
qemu-ppc-debuginfo - update to 7.1.0-150500.49.12.1
qemu-ppc - update to 7.1.0-150500.49.12.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 7.1.0-150500.49.12.1
qemu-s390x-debuginfo - update to 7.1.0-150500.49.12.1
qemu-s390x - update to 7.1.0-150500.49.12.1
qemu-hw-s390x-virtio-gpu-ccw - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu-pci - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu-pci-debuginfo - update to 7.1.0-150500.49.12.1
qemu-hw-display-virtio-gpu-debuginfo - update to 7.1.0-150500.49.12.1
qemu-accel-tcg-x86-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-alsa-debuginfo - update to 7.1.0-150500.49.12.1
qemu-audio-alsa - update to 7.1.0-150500.49.12.1
qemu-audio-pa - update to 7.1.0-150500.49.12.1
qemu-audio-pa-debuginfo - update to 7.1.0-150500.49.12.1
qemu-accel-tcg-x86 - update to 7.1.0-150500.49.12.1
qemu-x86 - update to 7.1.0-150500.49.12.1
qemu-x86-debuginfo - update to 7.1.0-150500.49.12.1
qemu-system-loongarch64-core - addressed in versions 8.2.0-17, 8.2.0-33
qemu-block-curl - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-loongarch64 - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-arm-core - update to 8.2.0-17
qemu-system-arm - update to 8.2.0-17
qemu-system-aarch64-core - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-aarch64 - addressed in versions 8.2.0-17, 8.2.0-33
qemu-pr-helper - addressed in versions 8.2.0-17, 8.2.0-33
qemu-kvm-core - addressed in versions 8.2.0-17, 8.2.0-33
qemu-kvm - addressed in versions 8.2.0-17, 8.2.0-33
qemu-img - addressed in versions 8.2.0-17, 8.2.0-33
qemu-guest-agent - addressed in versions 8.2.0-17, 8.2.0-33
qemu-docs - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-usb-smartcard - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-usb-redirect - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-riscv - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-riscv-core - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-x86 - addressed in versions 8.2.0-17, 8.2.0-33
qemu-system-x86-core - addressed in versions 8.2.0-17, 8.2.0-33
qemu-tests - addressed in versions 8.2.0-17, 8.2.0-33
qemu-tools - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-curses - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-dbus - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-egl-headless - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-gtk - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-opengl - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-spice-app - addressed in versions 8.2.0-17, 8.2.0-33
qemu-ui-spice-core - addressed in versions 8.2.0-17, 8.2.0-33
qemu-user - addressed in versions 8.2.0-17, 8.2.0-33
qemu-user-binfmt - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-display-virtio-vga-gl - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-usb-host - addressed in versions 8.2.0-17, 8.2.0-33
qemu - addressed in versions 8.2.0-17, 8.2.0-33
qemu-audio-alsa - addressed in versions 8.2.0-17, 8.2.0-33
qemu-audio-dbus - addressed in versions 8.2.0-17, 8.2.0-33
qemu-audio-oss - addressed in versions 8.2.0-17, 8.2.0-33
qemu-audio-pa - addressed in versions 8.2.0-17, 8.2.0-33
qemu-audio-spice - addressed in versions 8.2.0-17, 8.2.0-33
qemu-block-dmg - addressed in versions 8.2.0-17, 8.2.0-33
qemu-block-gluster - addressed in versions 8.2.0-17, 8.2.0-33
qemu-block-iscsi - addressed in versions 8.2.0-17, 8.2.0-33
qemu-char-baum - addressed in versions 8.2.0-17, 8.2.0-33
qemu-char-spice - addressed in versions 8.2.0-17, 8.2.0-33
qemu-common - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-display-qxl - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-display-virtio-gpu - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-display-virtio-gpu-ccw - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-display-virtio-gpu-pci - addressed in versions 8.2.0-17, 8.2.0-33
qemu-device-display-virtio-vga - addressed in versions 8.2.0-17, 8.2.0-33
qemu-block-ssh - addressed in versions 8.2.0-17, 8.2.0-33
qemu-block-rbd - update to 8.2.0-33
qemu-system-x86 (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system-arm (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system-mips (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system-misc (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system-ppc (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system-s390x (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-system-sparc (Ubuntu package) - update to 1:8.2.2+ds-0ubuntu1.2
qemu-sgabios - update to 8-150500.49.12.1
qemu-kvm (Red Hat package) - update to 9.0.0-10.el9_5

• https://lore.kernel.org/all/20240214-reuse-v4-5-89ad093a07f4%40daynix.com/
• https://security.netapp.com/advisory/ntap-20240419-0010/

• Privilege escalation in QEMU
• Red Hat Enterprise Linux 9 update for qemu-kvm
• SUSE update for qemu
• Ubuntu update for qemu
• Anolis OS update for qemu
• Anolis OS update for qemu