Izik Eidus found a bug in QEMU that allows priviledged guest user to force QEMU process on the host to issue free() and/or malloc() calls at addresses controlled by the guest user. The bug is in QXL/libspice code.

Izik Eidus found a bug in QEMU that allows priviledged guest user to touch arbitrary memory in the hosting QEMU process. The bug is in QXL code. Guest and host share region of memory and use it to communicate with each other. Malicious user can use the lack of validation of pointers embedded into data structures in this memory area to touch host's abitrary memory location and/or make the hosting QEMU process crash by dereferencing invalid pointer.

Izik Eidus found a bug in QEMU that allows priviledged guest user to touch arbitrary memory in the hosting QEMU process. The bug is in QXL/libspice code. Guest and host share region of memory and use it to communicate with each other. Malicious user can use the lack of validation of pointers embedded into data structures in this memory area to touch host's abitrary memory location and/or make the hosting QEMU process crash by dereferencing invalid pointer.

Gleb Napatov found a bug in KVM that can be used to crash the host on Intel machines. If emulator is tricked into emulating mov to/from DR instruction it causes NULL pointer dereference on VMX since kvmx86ops->(set|get)dr are not initialized. Recently this is not exploitable from guest userspace, but malicious guest kernel can trigger it easily.