CVE-2024-26328

What it actually does

register_vfs in hw/pci/pcie_sriov.c fails to set NumVFs to PCI_SRIOV_TOTAL_VF, causing mishandled interactions with hw/nvme/ctrl.c in affected virtualization code.

Why it matters to the business

Systems may experience unexpected virtual device behavior or instability, increasing operational risk and requiring prompt updates to avoid service disruptions.

How an attack unfolds

An attacker configures SR-IOV virtual functions on a vulnerable instance, triggering the incorrect NumVFs handling during NVMe controller interactions to induce undefined or erroneous device states.

How to fix it

Upgrade cordea/oauth (GIT) to commit ec2e058fc46f04deaf3cb55eca32b3b83c614953 or later; verify the change is present in deployed builds.

How to confirm the fix worked

Confirm the fixed commit is included in the running version and test SR-IOV VF registration with NVMe controllers to ensure NumVFs is set correctly.

Typical attack path

1. Identify systems running affected versions
2. Gain ability to configure PCI SR-IOV parameters
3. Trigger register_vfs path with NVMe device present
4. Observe or leverage resulting mishandled VF state

How to detect it

Review system and hypervisor logs for NVMe or PCI SR-IOV initialization errors around VF registration; search for unexpected device state after configuration changes.

What your security team should do

• Apply the referenced commit immediately due to the long window since publication
• Audit all virtualization deployments for the vulnerable code paths
• Monitor for any downstream dependents that may inherit the issue