CVE-2024-26328

Executive Summary

CVE-2024-26328 is a vulnerability in QEMU, affecting versions 7.1.0 through 8.2.1. The flaw resides in the register_vfs function within hw/pci/pcie_sriov.c, where the NumVFs field is not properly set to PCI_SRIOV_TOTAL_VF. This leads to a mishandled interaction with hw/nvme/ctrl.c, potentially allowing an attacker to cause a denial of service (DoS) or other undefined behavior. The vulnerability has a CVSS score of 0.0 (unscored) and no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. No official patch has been released, and the issue remains unpatched.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Vector: UNKNOWN
• Attack Vector (AV): UNKNOWN
• Attack Complexity (AC): UNKNOWN
• Privileges Required (PR): UNKNOWN
• User Interaction (UI): UNKNOWN
• Scope (S): UNKNOWN
• Confidentiality (C): UNKNOWN
• Integrity (I): UNKNOWN
• Availability (A): UNKNOWN

Threat Level: Low (due to no public exploit, low EPSS, and no patch). However, the potential for DoS makes it a concern for environments using QEMU with NVMe emulation.

Deep Dive & Mechanics

The vulnerability is in the register_vfs function in hw/pci/pcie_sriov.c. This function is responsible for registering Virtual Functions (VFs) for SR-IOV (Single Root I/O Virtualization) devices. The issue is that register_vfs does not set the NumVFs field to PCI_SRIOV_TOTAL_VF. This field is used by the NVMe controller (hw/nvme/ctrl.c) to determine the number of VFs to manage.

When the NVMe controller interacts with the PCIe SR-IOV subsystem, it expects NumVFs to be correctly set. Because it is not, the NVMe controller may misinterpret the number of VFs, leading to incorrect memory access, buffer overflows, or other undefined behavior. This can be triggered by a guest VM sending specific NVMe commands that cause the controller to iterate over VFs incorrectly.

The root cause is a missing assignment: sriov_cap->num_vfs = sriov_cap->total_vfs; (or similar) in register_vfs. This is a classic initialization error.

Vulnerable vs. Patched Code

Vulnerable Code (QEMU 7.1.0 - 8.2.1):

// hw/pci/pcie_sriov.c
static void register_vfs(PCIDevice *dev)
{
    // ... other code ...
    // Missing: sriov_cap->num_vfs = sriov_cap->total_vfs;
    // ... rest of function ...
}

Patched Code (Hypothetical Fix):

// hw/pci/pcie_sriov.c
static void register_vfs(PCIDevice *dev)
{
    // ... other code ...
    sriov_cap->num_vfs = sriov_cap->total_vfs; // Correct assignment
    // ... rest of function ...
}

The fix is a single line that ensures NumVFs is set to the total number of VFs before the NVMe controller uses it.

Exploitation & Lab Setup

Red Team

No public exploit code exists. To simulate exploitation, an attacker would need to:

1. Have a guest VM with QEMU NVMe emulation enabled.
2. Send crafted NVMe commands that trigger the VF iteration logic.
3. Cause a denial of service (e.g., QEMU crash) or potentially leak memory.

A proof-of-concept would involve:

# Hypothetical PoC (not functional)
import socket

def trigger_cve_2024_26328(qemu_host, qemu_port):
    # Craft NVMe admin command to exploit VF handling
    # This is a placeholder; actual exploit would require deep NVMe knowledge
    payload = b"\x00" * 64  # Placeholder
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((qemu_host, qemu_port))
    sock.send(payload)
    sock.close()

Blue Team

To detect exploitation attempts:

• Monitor QEMU logs for crashes or unusual NVMe errors.
• Use network monitoring to detect anomalous NVMe commands from guest VMs.
• Implement resource limits on VFs to mitigate DoS impact.

Indicators of Compromise (IOCs)

• Log Entries: QEMU crash logs containing references to pcie_sriov.c or nvme/ctrl.c.
• Network Traffic: Unusual NVMe admin commands targeting VF configuration.
• System State: QEMU process crash or hang when NVMe emulation is active.

Detection Engineering

YARA Rule

rule CVE_2024_26328_QEMU_SRIOV {
    meta:
        description = "Detects QEMU binary with vulnerable register_vfs function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-26328"
    strings:
        $vuln_func = "register_vfs" ascii wide nocase
        $missing_assign = "num_vfs" ascii wide nocase
    condition:
        $vuln_func and not $missing_assign
}

Sigma Rule

title: CVE-2024-26328 QEMU NVMe SR-IOV Vulnerability
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects QEMU crash logs related to CVE-2024-26328
logsource:
    product: qemu
    service: qemu-system
detection:
    selection:
        EventID: 1000  # Example crash event
        Message|contains:
            - "pcie_sriov.c"
            - "nvme/ctrl.c"
    condition: selection
falsepositives:
    - Legitimate QEMU crashes from other issues
level: medium

Suricata Rule

alert tcp any any -> any 16509 (msg:"CVE-2024-26328 QEMU NVMe SR-IOV Exploit Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; reference:cve,2024-26328; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: No official patch exists. Monitor QEMU mailing lists for updates.
2. Workaround: Disable SR-IOV for NVMe devices in QEMU configuration (e.g., remove -device nvme,.. or set sriov_max_vfs=0).
3. Mitigation: Restrict access to QEMU management interfaces (e.g., VNC, QMP) to trusted networks only.
4. Detection: Implement the YARA, Sigma, and Suricata rules above.
5. Monitoring: Enable QEMU logging and monitor for crashes.

Valters IT
DevSecOps & Cyber Threat Intelligence