QEMU vulnerabilities

Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.

Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.

A use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU allows attackers to cause a denial of service (QEMU instance crash) by failing to properly clear ifq_so from pending packets.

Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver or various parameters in the DMG block driver.

Multiple integer overflows in QEMU, before version 2.0.0, allow local users to cause a denial of service (crash) by providing crafted input, leading to buffer overflows and memory corruption.

qemu-nbd in QEMU does not ignore SIGPIPE, allowing remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.

A memory leak in audio/audio.c in QEMU allows remote attackers to cause a denial of service by repeatedly starting and stopping audio capture.

The disas_insn function in QEMU before version 2.9.0 does not limit instruction size in TCG mode without hardware acceleration, allowing local users to gain privileges by creating a modified basic block that injects code into a setuid program.

The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service through out-of-bounds write and application crash.

A memory leak in QEMU's net/vmxnet3.c allows remote attackers to cause a denial of service through excessive memory consumption.

A heap-based buffer overflow exists in QEMU when built with the Q35-chipset-based PC system emulator. This vulnerability may lead to unauthorized memory access.

The esp_reg_read and esp_reg_write functions in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via manipulation of the information transfer buffer.

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

The net_checksum_calculate function in QEMU allows local guest OS users to cause a denial of service through out-of-bounds heap read and crash by exploiting the payload length in a crafted packet.

The fw_cfg_write and fw_cfg_read functions in QEMU before version 2.4, when built with Firmware Configuration device emulation support, allow guest OS users with CAP_SYS_RAWIO privileges to cause denial of service or potentially execute arbitrary code via an invalid current entry value in firmware configuration.

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service via a large websocket payload or HTTP headers section.

The hw/ide/core.c file in QEMU does not properly restrict the commands accepted by an ATAPI device, allowing guest users to cause a denial of service or potentially other unspecified impacts via certain IDE commands.

Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before version 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.

Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image.

Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.

Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before version 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.

The virtio_scsi_load_request function in QEMU before version 1.7.2 may allow remote attackers to execute arbitrary code via a crafted savevm image, leading to an out-of-bounds array access.

The usb_device_post_load function in QEMU before version 1.7.2 may allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.

Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.

Multiple buffer overflows in the tsc210x_load function in QEMU before version 1.7.2 may allow remote attackers to execute arbitrary code via crafted values in a savevm image.

Multiple buffer overflows in the ssd0323_load function in QEMU before 1.7.2 allow remote attackers to cause a denial of service or possibly execute arbitrary code via crafted values.

The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.

Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.

Buffer overflow in the pxa2xx_ssp_load function in QEMU before version 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.

Buffer overflow in target-arm/machine.c in QEMU before version 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.

Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.

Buffer overflow in hw/pci/pcie_aer.c in QEMU before version 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large log_num value in a savevm image.

Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vectors related to the number of timers.

Buffer overflow in hw/ide/ahci.c in QEMU before version 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.

The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.

The virtio_net_load function in QEMU versions 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, leading to an out-of-bounds write.

Buffer overflow in the virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow remote attackers to execute arbitrary code via a large MAC table.

Off-by-one error in the cmd_smart function in the smart self test in QEMU before version 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.

A vulnerability in the UEFI implementation within QEMU (or similar software) causes a heap overflow in the hardware module (hw/uefi). An attacker can exploit this flaw to gain unauthorized access or execute arbitrary code.

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

The hw/input/ps2.c file in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.

Buffer overflow in the 'megasas_mmio_write' function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.

Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.

Buffer overflow in the pcnet_receive function in QEMU when a guest NIC has a larger MTU allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.

In QEMU, a type mismatch vulnerability exists in vhost inflight migration VMState handling. The destination buffer size is stored as uint64_t but read as int32_t, which on little-endian hosts can lead to out-of-bounds reads and crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel.

A flaw was found in QEMU allowing a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects.

A vulnerability was found in QEMU's virtio-snd driver. The `virtio_snd_pcm_in_cb` function does not check if the iov buffer is large enough for audio data, potentially leading to a heap out-of-bounds write. This issue is due to an incomplete fix for CVE-2024-7730.

A flaw in QEMU's virtio-blk device fails to validate input descriptor sizes before writing data. A privileged guest can submit a malformed SCSI request, causing an out-of-bounds write on the host heap memory.

A flaw was found in QEMU where a specially crafted VMDK image could trigger an out-of-bounds read vulnerability. This may lead to a 12-byte leak of sensitive information or a denial of service (DoS) condition.