QEMU Out-of-Bounds Write Vulnerability Allowing Memory Corruption and Potential Denial-of-Service

An out-of-bounds write vulnerability has been identified in QEMU. This issue allows a local attacker within a guest virtual machine to write data beyond the allocated memory. The vulnerability arises when the function 'cpu_physical_memory_map()' returns a shorter length than expected, leading to unauthorized memory access. Exploitation of this flaw could result in unauthorized access to guest memory, corruption of heap-allocated objects, and potentially cause information disclosure, data integrity issues, or a denial-of-service condition.

Impact

Exploitation of this vulnerability could lead to memory corruption, allowing attackers to modify control data and execute arbitrary code. It could also cause the application to crash, exit, or restart, and disrupt normal operations by creating undefined or unexpected states.

Reproduction

The vulnerability can be reproduced by using a guest virtual machine that runs QEMU. When the 'cpu_physical_memory_map()' function is called, it may return a length shorter than what was requested. Writing the full length of the requested bytes then causes an out-of-bounds access, either exceeding the memory allocated to the guest or interfering with a heap-allocated object.

Remediation

An upstream fix for this vulnerability is available in the QEMU GitLab repository.