Simon Rowe

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A bug in QEMU could cause a guest I/O operation to be targeted to offset 0 instead of an arbitrary disk offset, potentially overwriting the VM's boot code. This could allow an attacker to read and/or write data to LBA 0 of a virtual disk, potentially gaining control of the hypervisor at its next reboot. The vulnerability is related to errors in synchronization when handling the `DRQ STAT` parameter in the `ide dma cb()` function of the QEMU hardware emulator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.