Alexander Bulekov

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data count` and the size of `s->fifo buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** An integer overflow and buffer overflow issue were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the `read erst record()` and `write erst record()` functions. These issues may allow a malicious guest to overrun the host buffer allocated for the ERST memory device, potentially crashing the QEMU process on the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A use-after-free issue was found in the virtio-net device of QEMU. This could occur when the descriptor's address belongs to the non direct access region, due to `num buffers` being set after the `virtqueue` element has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU versions up to 6.0.0 **Description** A heap buffer overflow was found in the floppy disk emulator of QEMU. It could occur in `fdctrl transfer handler()` in `hw/block/fdc.c` while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host, resulting in a denial-of-service scenario, or potential information leakage from the host memory. **Recommendations** For QEMU versions up to 6.0.0, as a temporary workaround, consider disabling the `fdctrl transfer handler()` function until a patch is available. Restrict access to the `hw/block/fdc.c` component to minimize the risk of exploitation. Avoid using the floppy disk emulator until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in `process tx desc` if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 6.0.0 **Description** A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this issue is to system availability. **Recommendations** For versions prior to 6.0.0, update to version 6.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCSI emulation support to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 6.0.0 **Description** The issue is related to a use-after-free vulnerability in the am53c974 SCSI host bus adapter emulation of QEMU. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. A privileged guest user can crash the QEMU process on the host, potentially leading to code execution with the privileges of the QEMU process. The vulnerability is triggered during the handling of the 'Information Transfer' command (CMD TI). **Recommendations** For versions prior to 6.0.0, update to version 6.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the am53c974 SCSI host bus adapter emulation to minimize the risk of exploitation. Avoid using the 'Information Transfer' command (CMD TI) in the affected QEMU process until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 5.2.0 **Description** A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. **Recommendations** For QEMU versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the memory management API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU version 4.2.0 **Description** The issue is related to a buffer data boundary operation overflow in QEMU, which can be exploited to access confidential data, compromise data integrity, and cause a denial of service. Specifically, the `hw/pci/msix.c` file in QEMU allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. **Recommendations** For QEMU version 4.2.0, consider restricting access to the `hw/pci/msix.c` file or the msi-x mmio operation to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU version 4.2.0 **Description** The issue is related to a NULL pointer dereference in the `address space map` function in `exec.c`, which is connected to `BounceBuffer`. This can potentially lead to a denial of service. **Recommendations** For QEMU version 4.2.0, consider updating to a newer version that contains a fix for this issue, as the current version can trigger a NULL pointer dereference related to `BounceBuffer`. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU version 4.2.0 **Description** The issue is related to a use-after-free in the e1000e core of QEMU's hardware emulation, specifically in the hw/net/e1000e core.c file. This can be triggered by a guest OS user sending an e1000e packet with its data address set to the e1000e's MMIO address, potentially leading to a denial of service. **Recommendations** For QEMU version 4.2.0, consider disabling the e1000e core functionality until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.