qemu: arbitrary code execution

The guest operating system communicates with the FDC by sending commands
such as seek, read, write, format, etc. to the FDC’s input/output port.
QEMU’s virtual FDC uses a fixed-size buffer for storing these commands
and their associated data parameters. The FDC keeps track of how much
data to expect for each command and, after all expected data for a given
command is received from the guest system, the FDC executes the command
and clears the buffer for the next command.

This buffer reset is performed immediately at the completion of
processing for all FDC commands, except for two of the defined commands.
An attacker can send these commands and specially crafted parameter data
from the guest system to the FDC to overflow the data buffer and execute
arbitrary code in the context of the host’s hypervisor process.