A flaw was found in the way the QEMU-KVM handled erroneous data provided by the guest Linux virtio-net driver. Due deficiency in the implementation of the TSO (TCP segment offloading), the guest's virtio-net driver transmitted improper data to the particular QEMU-KVM process on the host, resulting in its termination. A remote attacker could use this flaw to cause denial of service (guest crash) by sending certain, specially-crafted data to arbitrary open port on the target guest system.

A remote attacker could exploit this to crash guests which use virtio networking on Linux kernels earlier than 2.6.26.

Paolo Bonzini found a bug in KVM that can be used to bypass proper permission checking while loading segment selectors. Malicious guest userspace process running in SMP guest can trick the emulator into loading kernel segment selector if it has access to IO port or MMIO region. To do so it should run legitimate instruction that does IO and will cause vcpu to enter emulator in one thread and replace this instruction to kernel selector loading one from another thread. If instruction is replaced after KVM entered emulator, but before instruction is fetched emulator will be tricked to execute privileged instruction without permission checking.

Gleb Napatov found a bug in KVM that can be used to bypass proper IOPL/CPL checking. KVM relies on CPU to check IOPL/CPL before instruction execution, so emulator doesn't do IOPL/CPL checking. Malicious guest process running in SMP guest can bypass CPU IOPL/CPL checking if it has access to IO port or MMIO region. To do so it should run legitimate instruction that does IO and will cause vcpu to enter emulator in one thread and replace this instruction to malicious one from another thread. If instruction is replaced after KVM entered emulator, but before instruction is fetched emulator will be tricked to execute privileged instruction without permission checking.