Beat
QEMU
QEMU emulator and virtualization news
VAPIC writable window could cover SMRAM or PCI BARs
QEMU mapped the virtual APIC acceleration ROM as high-priority writable RAM. The fix confines the region to option-ROM low memory.
SCSI WRITE SAME can copy host heap into the guest disk
A guest with an emulated SCSI disk can race a block-size change against WRITE SAME so QEMU reads tens of kilobytes past a host heap buffer and writes that memory into the guest's own image. The fix clamps the copy to the buffer that was actually allocated.
IBM Z protected service-call copy can read past a host heap buffer
On IBM Z, a guest talks to QEMU through a small service-call control block. The protected-virtualization copy of that block could read past the host buffer, because a later rewrite of the request length was used as the copy size.
Guest CHS setup can crash QEMU with a divide by zero
CHS is the old cylinders-heads-sectors way a guest describes a disk. A guest can set sectors-per-track to zero, and the next CHS read or write then divides by that zero and kills the QEMU process.
Disk command-list unmap can point at freed host memory
The AHCI host adapter maps the guest's command list in host memory. If that list sits on an MMIO region, unmapping it frees a bounce buffer, and a later programmed-I/O completion still used the old pointer.
Surprise disk unplug can free host memory under an in-flight request
On a PCIe machine, a guest can power the disk slot off while a read is still in flight. The host then finishes that request against memory it already freed.
Incoming IDE migration can write host heap
QEMU keeps a small buffer for an in-progress disk transfer. A crafted incoming migration stream could point that window off the buffer, and the resumed guest then turns data-port writes into a host heap write.
QEMU ships v11.1.1, v11.0.4, and v10.0.13
Three stable point releases landed on the public tree. They bump the version and include the pseries watchdog bound check, but not the VGA or QXL CVEs that landed on master with the graphics pull.
QEMU can use freed serial state if the port is hot-unplugged
The emulated serial port leaves a transmit retry callback armed when the device is removed. If that callback fires after unplug, QEMU can touch memory that is already gone.
A pseries guest can poke one slot before the watchdog table
pseries is the default IBM POWER virtual machine. A guest hypercall that starts the watchdog accepted index zero and then used the slot before the start of the table, which tripped a host sanitizer crash.
A virtio-gpu guest can abort the QEMU process by asking for a huge allocation
virtio-gpu is the virtio display device. A guest could ask for a memory allocation large enough that the host allocator aborted the whole QEMU process instead of returning an error.
QEMU QXL display can read past video RAM on a guest-chosen stride
QXL is the Spice display device many Linux guests use. A guest can create a primary surface whose row width is smaller than the pixel width it declared, and the next host screen refresh then reads past the video buffer.
QEMU VGA can write past the display surface after a mode switch
VGA is the default display chip on a typical PC virtual machine. After a guest flips from graphics to text, QEMU can paint into a too-small surface using colors the guest chose, which writes off the end of host memory on every screen refresh.
A QEMU guest can make the Realtek NIC read past a short packet
The old Realtek 8139 NIC that QEMU emulates can over-read a few bytes when a guest loops a short VLAN-tagged packet back to itself. The fix is on master.
A QEMU guest display wrap is public, already fixed in 11.1.0
QEMU can show a guest display from a blob of guest memory. A guest-controlled offset could wrap a 32-bit number and point that display at the wrong place in the blob.
A guest can abort QEMU through USB storage or a VMware NIC
USB Attached SCSI and VMware's paravirtual NIC are guest devices QEMU emulates. A guest that sent a too-small status buffer or a bogus interrupt number used to kill the QEMU process.
A guest can crash QEMU by sending a bad console message
On s390, a guest can send a console message of the wrong length and trip an assert that kills QEMU. That is a crash, not a guest-to-host escape.
A public report says a guest disk copy can smash host heap
A public QEMU bug claims a guest copy command can write off the end of a host buffer when integrity metadata and namespace sizes disagree. There is no fix, and maintainers have not confirmed it.
QEMU 11.1.0 is the security-bearing 11.1 release
QEMU 11.1.0 is out, with isolation fixes for shared folders, virtual GPU, USB, and the usual virtual NIC. This is the first 11.1 tag.