A heap buffer overflow was found in the Message Signaled Interrupt (MSI-X) device support of QEMU. The overflow could occur due to an out-of-bounds write of the MSIX table while performing MSI-X mmio operations in msix_table_mmio_write(). A guest user may exploit this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
A heap buffer overflow was found in the Message Signaled Interrupt (MSI-X) device support of QEMU. The overflow could occur due to an out-of-bounds write of the MSIX table while performing MSI-X mmio operations in msix_table_mmio_write(). A guest user may exploit this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
https://bugzilla.redhat.com/show_bug.cgi?id=1902651 https://bugzilla.redhat.com/show_bug.cgi?id=1902651#c6
Vulmon