Jason Wang

The issue is related to the virtio-net component in the Linux kernel, where pages leak when building skb in big mode. This happens because the code tries to use build skb() when there is sufficient tailroom, but it forgets to release the unused pages chained via private in big mode, resulting in page leaks. The fix involves releasing the pages after building the skb in big mode.

The issue is related to the virtqueue doorbell mapping in the Linux kernel. The virtqueue doorbell is usually implemented via registers, but the necessary vma->flags like VM PFNMAP are not provided. This may cause several issues, such as a kernel panic, when userspace tries to map the doorbell via vhost IOTLB. The patch fixes this by setting the necessary vm flags, causing attempts to map the doorbell via IOTLB to fail with a bad address.

The issue is related to a buffer overflow in the hw/net/tulip.c component of the QEMU hardware emulator. This occurs during the copying of tx/rx buffers because the frame size is not validated against the r/w data length. Exploitation of this issue could allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

A flaw in the Linux kernel's handle rx() function in the vhost net driver can be exploited by a malicious virtual guest to trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host. This may lead to kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

The issue is related to a buffer overflow in the `pcnet receive` function, which can be triggered when a guest NIC has a larger MTU, allowing remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.

The issue is related to the virtnet probe function in the Linux kernel, which fails to properly allocate memory when supporting the FRAGLIST feature. This allows guest OS users to cause a denial of service by sending a crafted sequence of fragmented packets, resulting in a buffer overflow and memory corruption.

A flaw was found in the way qemu validates addresses when a guest accesses the config space of a virtio device. If the virtio device has zero or small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop. This can be achieved by sending a packet with IPIP encapsulation that contains a small value in the IHL field.