REDHAT-BUG-2513498: Low severity Qemu Qemu vulnerability
QEMU's vhost inflight migration VMState handling uses a uint64t field for the destination buffer size, while the VMSVBUFFER load path reads the field as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set can cause the negative value to be converted to a very large sizet. QEMU may then copy migration-stream data beyond the mmap-backed destination inflight region, causing a destination QEMU process crash or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel and a configuration using vhost inflight migration.
Acknowledgments: Seungjung Kim (Kyonggi University)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent exploitation by not allowing attackers to gain control of the migration producer or write access to the migration channel, and avoid running a configuration that uses vhost inflight migration.