Out-of-bounds Write

qemu is vulnerable to Out-of-bounds Write. The vulnerability is due to there is no proper bounds checking in the virtio_net_flush_tx function of QEMU’s virtio-net device when certain guest features are enabled. This oversight allows for a stack-based buffer overflow, enabling a malicious user to overwrite local variables on the stack, including the out_sg variable, leading to potential Denial of Service.