Yongkang Jia

Name of the Vulnerable Software and Affected Versions: QEMU (affected versions not specified) Description: A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for `virtqueue push` as set in `virtio scsi complete req`, `virtio blk req complete`, and `virtio crypto req complete` could be larger than the true size of the data sent to the guest. This may lead to an information leak due to uninitialized data in the `bounce.buffer`. Attackers may crash the system or execute code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a NULL pointer dereference flaw in the Linux kernel's KVM module. This flaw can lead to a denial of service in the `x86 emulate insn` function in `arch/x86/kvm/emulate.c`. The flaw occurs when an illegal instruction is executed in a guest on an Intel CPU. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to the fixed version **Description** The issue is related to a NULL pointer dereference in the KVM subsystem of the Linux kernel, specifically in the `kvm dirty ring push` function. This flaw can be exploited by an unprivileged local attacker on the host to cause a denial of service by issuing specific ioctl calls, resulting in a kernel oops condition. **Recommendations** For Linux Kernel versions prior to the fixed version, consider disabling the dirty ring support as a temporary workaround until a patch is available. Restrict access to the vulnerable `kvm dirty ring push` function to minimize the risk of exploitation. Avoid using specific ioctl calls that can cause a kernel oops condition until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to the fixed version **Description** A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. The issue is related to the `get user pages fast()` function and involves writing data outside the buffer in memory. This flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. The `vaddr` and `vm pgoff` variables are controllable by user-mode processes, which can be exploited to cause the issue. **Recommendations** For Linux Kernel versions prior to the fixed version, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the KVM subsystem to minimize the risk of exploitation. Avoid using the `get user pages fast()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw in the Linux kernel's KVM allows a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This issue enables an unprivileged local attacker on the host to issue specific ioctl calls, resulting in a kernel oops condition that causes a denial of service. The vulnerability is related to errors in pointer dereferencing in the kvm irq delivery to apic fast() function of the Kernel-based Virtual Machine (KVM) subsystem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to pointer dereference errors in the Linux kernel. It allows an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, with shadow paging enabled, the INVPCID instruction results in a call to `kvm mmu invpcid gva`. If INVPCID is executed with CR0.PG=0, the `invlpg` callback is not set, leading to a NULL pointer dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.