Astra Linux – Vulnerability in Qemu

A reentrancy issue related to DMA was discovered in the USB EHCI controller emulation of QEMU. EHCI does not verify whether the Buffer Pointer overlaps with its MMIO region when transferring USB packets. Crafted content may be written to the controller’s registers, potentially triggering...

qemu-kvm DoS

The vulnerability of the qemu-kvm hardware emulation package from QEMU is related to the lack of checks to ensure that the buffer pointer does not overlap with the MMIO region during USB packet transmission. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2023-9177

Name of the Vulnerable Software and Affected Versions qemu-kvm affected versions not specified Description The issue is related to a lack of checks for buffer pointer overlap with the MMIO region when transferring USB packets in the QEMU hardware emulator. Exploitation of this issue could allow a...

A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host resulting in a denial of service condition or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.

...