Cheolwoo Myung

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in `process tx desc` if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error in the `mptsas free request()` function that does not dequeue the request object `req` from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.

The issue is related to a use-after-free vulnerability in the am53c974 SCSI host bus adapter emulation of QEMU. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. A privileged guest user can crash the QEMU process on the host, potentially leading to code execution with the privileges of the QEMU process. The vulnerability is triggered during the handling of the 'Information Transfer' command (CMD TI).

A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this issue is to system availability.

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.