Off-by-one error in the cmdsmart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.

A buffer overflow flaw was found in the way qemu processed MAC addresses table update requests from the guest.

A privileged guest user could use this flaw to corrupt qemu process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the qemu process.

Acknowledgements:

This issue was discovered by Michael S. Tsirkin of Red Hat.

Buffer overflow in the usbhosthandlecontrol function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 allows guest OS users to cause a denial of service (guest OS crash or hang) or possibly execute arbitrary code on the host OS via a crafted USB packet.

A flaw was found in the way the QEMU-KVM handled erroneous data provided by the guest Linux virtio-net driver. Due deficiency in the implementation of the TSO (TCP segment offloading), the guest's virtio-net driver transmitted improper data to the particular QEMU-KVM process on the host, resulting in its termination. A remote attacker could use this flaw to cause denial of service (guest crash) by sending certain, specially-crafted data to arbitrary open port on the target guest system.

A remote attacker could exploit this to crash guests which use virtio networking on Linux kernels earlier than 2.6.26.