A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2036966 | third party advisory issue tracking |
| https://starlabs.sg/advisories/21-4207/ | third party advisory exploit |
| https://www.debian.org/security/2022/dsa-5133 | third party advisory vendor advisory |
| https://security.gentoo.org/glsa/202208-27 | third party advisory vendor advisory |
| https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html | third party advisory mailing list |
| https://security.netapp.com/advisory/ntap-20250321-0009/ |