CVE-2022-4144

An out-of-bounds read flaw was found in the QXL display device emulation in
QEMU. The qxl_phys2virt() function does not check the size of the structure
pointed to by the guest physical address, potentially reading past the end
of the bar space into adjacent pages. A malicious guest user could use this
flaw to crash the QEMU process on the host causing a denial of service
condition.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=2148506&gt;
• <https://gitlab.com/qemu-project/qemu/-/issues/1336&gt;