heap buffer overflow vulnerability in pcnet emulator

ISSUE DESCRIPTION

The QEMU security team has predisclosed the following advisory:
The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets in loopback mode, appends CRC code to the receive buffer. If the data size given is same as the buffer size(4096), the appended CRC code overwrites 4 bytes after the s->buffer, making the adjacent ‘s->irq’ object point to a new location.

IMPACT

A guest which has access to an emulated PCNET network device (e.g. with “model=pcnet” in their VIF configuration) can exploit this vulnerability to take over the qemu process elevating its privilege to that of the qemu process.

VULNERABLE SYSTEMS

All Xen systems running x86 HVM guests without stubdomains which have been configured to use the PCNET emulated driver model are vulnerable.
The default configuration is NOT vulnerable (because it does not emulate PCNET NICs).
Systems running only PV guests are NOT vulnerable.
Systems using qemu-dm stubdomain device models (for example, by specifying “device_model_stubdomain_override=1” in xl’s domain configuration files) are NOT vulnerable.
Both the traditional “qemu-xen” or upstream qemu device models are potentially vulnerable.
ARM systems are NOT vulnerable.