qemu: virtio: insufficient validation of num_sg when mapping

The virtqueuemapsg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read...

qemu: virtio: insufficient validation of num_sg when mapping

An user able to alter the savevm data either on the disk or over the wire during migration could use this flaw to to corrupt QEMU process memory on the destination host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process...