REDHAT-BUG-2513498: Low severity Qemu Qemu vulnerability
QEMU's vhost inflight migration VMState handling uses a uint64t field for the destination buffer size, while the VMSVBUFFER load path reads the field as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set can cause the negative value to be converted to a very large sizet. QEMU may then copy migration-stream data beyond the mmap-backed destination inflight region, causing a destination QEMU process crash or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel and a configuration using vhost inflight migration.
Acknowledgments: Seungjung Kim (Kyonggi University)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent exploitation by not allowing attackers to gain control of the migration producer or write access to the migration channel, and avoid running a configuration that uses vhost inflight migration.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2513498?
The severity of REDHAT-BUG-2513498 is categorized as low.
What does REDHAT-BUG-2513498 describe?
REDHAT-BUG-2513498 describes an issue with QEMU's vhost inflight migration VMState handling related to type mismatches in buffer size representation.
How do I fix REDHAT-BUG-2513498?
To fix REDHAT-BUG-2513498, ensure you apply the latest patches provided by the QEMU development team that address this specific vulnerability.
What components are affected by REDHAT-BUG-2513498?
REDHAT-BUG-2513498 affects the QEMU virtualization software, specifically its vhost inflight migration handling.
What is the potential impact of REDHAT-BUG-2513498?
The potential impact of REDHAT-BUG-2513498 includes the risk of negative value conversions during migration on little-endian hosts, which could lead to instability or exploitation.