Li Qiang

The issue is related to a buffer overflow in the hw/net/tulip.c component of the QEMU hardware emulator. This occurs during the copying of tx/rx buffers because the frame size is not validated against the r/w data length. Exploitation of this issue could allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

A heap buffer out-of-bounds read/write access issue was discovered in the NVM Express Controller emulation of QEMU, specifically in the nvme cmb ops routines of the nvme device. This issue could allow a guest user or process to crash the QEMU process, resulting in a denial of service (DoS), or potentially execute arbitrary code with the privileges of the QEMU process.

A stack-based buffer overflow issue exists, allowing local guest OS users to cause a denial of service by crashing the QEMU process. This issue is related to logging debug messages in the hw/usb/redirect.c component.

A memory leak issue exists, allowing local guest OS privileged users to cause a denial of service through memory consumption. This issue involves the `orig value` variable in the `v9fs list xattr` function.

The issue allows local guest OS privileged users to cause a denial of service, specifically file descriptor or memory consumption, via certain vectors related to an already in-use fid. This is due to the v9fs create and v9fs lcreate functions in hw/9pfs/9p.c.

The issue is caused by an integer overflow in the hw/virtio/virtio-crypto.c component of QEMU, allowing local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host. This can be achieved by sending a crafted virtio-crypto request, which triggers a heap-based buffer overflow.

The issue is caused by an integer overflow in the `vmw surface define ioctl` function. This can be exploited by a local attacker to cause a denial of service, such as a system hang or crash, or possibly gain privileges, by making a crafted ioctl call for a `/dev/dri/renderD*` device. The exploitation allows for out-of-bounds write, which can lead to system instability or privilege escalation.

The issue allows local guest OS users to cause a denial of service, resulting in an out-of-bounds array access and a QEMU process crash. This is achieved through vectors involving `vertext buffer index`.

The issue is related to a memory leak in the `virgl resource attach backing` function. This leak allows local guest OS users to cause a denial of service by consuming memory through a large number of `VIRTIO GPU CMD RESOURCE ATTACH BACKING` commands.

The issue allows local guest OS users to cause a denial of service by destroying context 0, resulting in a NULL pointer dereference and a QEMU process crash. This is due to a problem in the `vrend decode reset` function.

The issue is related to a heap-based buffer overflow in the `vrend create vertex elements state` function, located in `vrend renderer.c`. This occurs when the `num elements` parameter is used to cause an out-of-bounds array access, leading to a denial of service and potential crash.

The issue is related to a memory leak in the `add shader program` function, which can be exploited by local guest OS users to cause a denial of service through host memory consumption. This is achieved via vectors involving the `sprog` variable.

The issue is related to a memory leak in the `vrend renderer context create internal` function in `vrend decode.c`. This allows local guest OS users to cause a denial of service by repeatedly creating a decode context, resulting in host memory consumption.

The issue is related to a stack-based buffer overflow in the `parse identifier` function, located in the `tgsi text.c` file within the TGSI auxiliary module of the Gallium driver in virglrenderer. This overflow allows local guest OS users to cause a denial of service by accessing an array out of its bounds, leading to a crash of the QEMU process. The vulnerability is related to vectors associated with parsing properties.

The issue allows local guest OS users to cause a denial of service, resulting in an out-of-bounds array access and process crash, via a crafted texture instruction. This is due to a problem in the parse instruction function.

The issue is related to a memory leak in the `vrend create vertex elements state` function in `vrend renderer.c`. This allows local guest OS users to cause a denial of service by consuming host memory via a large number of `VIRGL OBJECT VERTEX ELEMENTS` commands.

The issue is related to a memory leak in the `vcard apdu new` function, located in the `card 7816.c` file of the libcacard library. This memory leak allows local guest OS users to cause a denial of service by consuming host memory. The denial of service is achieved through vectors related to allocating a new APDU object.

The issue allows local guest OS users to cause a denial of service via a crafted VIRGL CCMD CLEAR command, resulting in a NULL pointer dereference. This occurs due to a problem in the util format is pure uint function in vrend renderer.c.

The issue is related to a memory leak in the `vrend renderer init blit ctx` function, located in `vrend blitter.c`. This leak can be triggered by local guest OS users, allowing them to cause a denial of service by consuming host memory. The memory leak is exploited via a large number of `VIRGL CCMD BLIT` commands.

The issue allows local guest OS users to cause a denial of service, resulting in an infinite loop. This is achieved through vectors involving the number of link endpoint list descriptors in the ohci service ed list function.