REDHAT-BUG-2254580: Buffer Overflow

A stack based buffer overflow was found in the virtio-net device of QEMU. The flaw occurs while copying data to mhdr, a local variable of type virtionethdrmrgrxbuf, when flushing TX in the virtionetflushtx function. If guest features VIRTIONETFHASHREPORT, VIRTIOFVERSION1 and VIRTIONETFMRGRXBUF are enabled, n->guesthdrlen is set to sizeof(struct virtionethdrv1hash), which is bigger than sizeof(virtionethdrmrgrxbuf). This vulnerability could potentially allow a malicious user to overwrite local variables adjacent to mhdr allocated on the stack. Specifically, the outsg variable could be used to read some part of process memory and send it to the wire:

ret = qemusendvpacketasync(qemugetsubqueue(n->nic, queueindex), outsg, outnum, virtionettxcomplete);