Beat
QEMU
QEMU emulator and virtualization news
VAPIC writable window could cover SMRAM or PCI BARs
QEMU mapped the virtual APIC acceleration ROM as high-priority writable RAM. The fix confines the region to option-ROM low memory.
SCSI WRITE SAME can copy host heap into the guest disk
A guest with an emulated SCSI disk can race a block-size change against WRITE SAME so QEMU reads tens of kilobytes past a host heap buffer and writes that memory into the guest's own image. The fix clamps the copy to the buffer that was actually allocated.
IBM Z protected service-call copy can read past a host heap buffer
On IBM Z, a guest talks to QEMU through a small service-call control block. The protected-virtualization copy of that block could read past the host buffer, because a later rewrite of the request length was used as the copy size.
Disk command-list unmap can point at freed host memory
The AHCI host adapter maps the guest's command list in host memory. If that list sits on an MMIO region, unmapping it frees a bounce buffer, and a later programmed-I/O completion still used the old pointer.
Surprise disk unplug can free host memory under an in-flight request
On a PCIe machine, a guest can power the disk slot off while a read is still in flight. The host then finishes that request against memory it already freed.
Incoming IDE migration can write host heap
QEMU keeps a small buffer for an in-progress disk transfer. A crafted incoming migration stream could point that window off the buffer, and the resumed guest then turns data-port writes into a host heap write.
QEMU ships v11.1.1, v11.0.4, and v10.0.13
Three stable point releases landed on the public tree. They bump the version and include the pseries watchdog bound check, but not the VGA or QXL CVEs that landed on master with the graphics pull.
A pseries guest can poke one slot before the watchdog table
pseries is the default IBM POWER virtual machine. A guest hypercall that starts the watchdog accepted index zero and then used the slot before the start of the table, which tripped a host sanitizer crash.
QEMU QXL display can read past video RAM on a guest-chosen stride
QXL is the Spice display device many Linux guests use. A guest can create a primary surface whose row width is smaller than the pixel width it declared, and the next host screen refresh then reads past the video buffer.
QEMU VGA can write past the display surface after a mode switch
VGA is the default display chip on a typical PC virtual machine. After a guest flips from graphics to text, QEMU can paint into a too-small surface using colors the guest chose, which writes off the end of host memory on every screen refresh.