Michael S. Tsirkin

The issue allows local users to cause a denial of service, specifically memory consumption, by making a VHOST SET LOG FD ioctl call that triggers permanent file-descriptor allocation. This occurs due to a problem in the vhost dev ioctl function in drivers/vhost/vhost.c.

A heap-based buffer overflow issue exists in the virtio load function, located in hw/virtio/virtio.c, which could potentially allow remote attackers to execute arbitrary code. This is achievable by providing a crafted config length in a savevm image.

The issue allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices.

The issue is related to a buffer overflow in the hw/pci/pcie aer.c file. This can be exploited by remote attackers to cause a denial of service and potentially execute arbitrary code. The exploitation is possible via a large log num value in a savevm image.

The issue is related to a buffer overflow in the hw/ssi/pl022.c file, which can be triggered by remote attackers sending crafted `tx fifo head` and `rx fifo head` values in a savevm image. This can cause a denial of service or potentially allow the execution of arbitrary code.

A buffer overflow issue exists, allowing remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in `cpreg vmstate array len` in a savevm image.

A buffer overflow issue exists in the pxa2xx ssp load function, located in hw/arm/pxa2xx.c, which can be triggered by a crafted s->rx level value in a savevm image. This can lead to a denial of service or potentially allow remote attackers to execute arbitrary code.

A buffer overflow issue exists, allowing remote attackers to cause a denial of service or possibly execute arbitrary code. This issue is related to vectors involving IRQDest elements in the hw/intc/openpic.c file.

The issue allows remote attackers to execute arbitrary code via a crafted `arglen` value in a savevm image. This is related to the `ssi sd transfer` function in `hw/sd/ssi-sd.c`.

The issue is related to multiple buffer overflows in the `ssd0323 load` function, which can be triggered by crafted values in a savevm image, including `cmd len`, `row`, `col`, `row start`, `row end`, `col start`, and `col end`. This can cause a denial of service due to memory corruption or possibly allow the execution of arbitrary code.

The issue is related to multiple buffer overflows in the `tsc210x load` function, which might allow remote attackers to execute arbitrary code. This can be achieved by crafting specific values in a savevm image, including `precision`, `nextprecision`, `function`, or `nextfunction`.

A buffer overflow issue exists in the scoop gpio handler update function. This could potentially allow remote attackers to execute arbitrary code by providing a large value for `prev level`, `gpio level`, or `gpio dir` in a savevm image.

The issue is related to the `usb device post load` function in `hw/usb/bus.c`, which might allow remote attackers to execute arbitrary code via a crafted savevm image. This is due to a negative `setup len` or `setup index` value.

The issue allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.

The issue is related to a buffer overflow in the hw/ide/ahci.c file. This can be exploited by remote attackers to cause a denial of service and potentially execute arbitrary code, specifically through vectors related to migrating ports.

The issue is related to a buffer overflow in the hw/timer/hpet.c file. This might allow remote attackers to execute arbitrary code via vectors related to the number of timers.

The issue is related to an array index error in the `virtio load` function, located in `hw/virtio/virtio.c`. This error allows remote attackers to execute arbitrary code via a crafted savevm image.

The issue is caused by an integer signedness error in the virtio net load function, which can be exploited by remote attackers to execute arbitrary code via a crafted savevm image. This triggers a buffer overflow.

The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code. This is achieved through vectors where the value of `curr queues` is greater than `max queues`, triggering an out-of-bounds write.

The issue is related to the savevm functionality of the QEMU hardware emulator, which can be exploited to alter savevm data. This could allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. An attacker able to modify the savevm data could potentially corrupt the QEMU process memory on the host, leading to arbitrary code execution with the privileges of the QEMU process.