REDHAT-BUG-2536950: Medium severity Qemu QEMU VAPIC (hw/i386/vapic.c) vulnerability
A flaw was found in QEMU's VAPIC (Virtual Advanced Programmable Interrupt Controller) implementation in hw/i386/vapic.c. The 16-bit VAPIC setup hypercall allows a privileged guest to specify both the base address and size of a high-priority writable RAM alias. QEMU does not validate that this alias remains within the VAPIC option ROM boundaries (0xc0000..0xdffff). A malicious guest administrator can place the alias over 0xa0000..0xbffff, bypassing the Q35 chipset's DLCK-protected SMRAM and modifying memory that executes in System Management Mode. This could allow a privileged guest user to inject arbitrary code into locked SMRAM.
Upstream fix: https://gitlab.com/qemu-project/qemu/-/commit/d61c8a6fb7388486353aa267ba0d75b098f16662
Reference: https://gitlab.com/qemu-project/qemu/-/workitems/4206
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs privileged administrative control within a guest. The issue is not described as exploitable by an unprivileged guest user.
Which guest configurations are most relevant to triage?
The flaw involves QEMU's VAPIC implementation and the 16-bit VAPIC setup hypercall. The described impact specifically relies on bypassing D_LCK-protected SMRAM in a guest using the Q35 chipset.