Alexander Bulekov

A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data count` and the size of `s->fifo buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

An integer overflow and buffer overflow issue were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the `read erst record()` and `write erst record()` functions. These issues may allow a malicious guest to overrun the host buffer allocated for the ERST memory device, potentially crashing the QEMU process on the host.

A use-after-free issue was found in the virtio-net device of QEMU. This could occur when the descriptor's address belongs to the non direct access region, due to `num buffers` being set after the `virtqueue` element has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

A heap buffer overflow was found in the floppy disk emulator of QEMU. It could occur in `fdctrl transfer handler()` in `hw/block/fdc.c` while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host, resulting in a denial-of-service scenario, or potential information leakage from the host memory.

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in `process tx desc` if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this issue is to system availability.

The issue is related to a use-after-free vulnerability in the am53c974 SCSI host bus adapter emulation of QEMU. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. A privileged guest user can crash the QEMU process on the host, potentially leading to code execution with the privileges of the QEMU process. The vulnerability is triggered during the handling of the 'Information Transfer' command (CMD TI).

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service.

The issue is related to a buffer data boundary operation overflow in QEMU, which can be exploited to access confidential data, compromise data integrity, and cause a denial of service. Specifically, the `hw/pci/msix.c` file in QEMU allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

The issue is related to a NULL pointer dereference in the `address space map` function in `exec.c`, which is connected to `BounceBuffer`. This can potentially lead to a denial of service.

The issue is related to a use-after-free in the e1000e core of QEMU's hardware emulation, specifically in the hw/net/e1000e core.c file. This can be triggered by a guest OS user sending an e1000e packet with its data address set to the e1000e's MMIO address, potentially leading to a denial of service.