On 2026/07/16 5:10, [email protected] wrote:
From: Marc-André Lureau <[email protected]>Validate that the framebuffer stride is at least width * bytes_per_pixel in both virtio_gpu_scanout_blob_to_fb() and virtio_gpu_do_set_scanout(). A guest can set a very small stride while using a large width. The total size check (offset + stride * height <= blob_size) passes because stride * height is small, but pixman reads width * bytes_per_pixel per row, causing heap OOB reads. The leaked data is rendered to the host display. The check is added in virtio_gpu_do_set_scanout() to cover all paths: blob scanout, non-blob scanout and migration post_load. The additional early check in virtio_gpu_scanout_blob_to_fb() rejects invalid blob configurations early. Fixes: CVE-2026-63109 Fixes: 144bd171c837 ("virtio-gpu: Support blob scanout using dmabuf fd") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3989 Signed-off-by: Marc-André Lureau <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
