Chuhong Yuan

A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data count` and the size of `s->fifo buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

The issue is related to a division by zero in the `scsi disk reset` function in `hw/scsi/scsi-disk.c` due to incorrect block size checking by `scsi disk emulate mode select`. This can cause QEMU and the guest to stop immediately. Exploitation of this issue may allow a remote attacker to cause a denial of service.

The issue is related to the go7007 snd init function in the Linux kernel, which does not properly free resources in case of failure, leading to a memory leak. This can potentially allow an attacker to cause a denial of service.