On 2026/07/16 16:37, Akihiko Odaki wrote:
On 2026/07/16 5:10, [email protected] wrote:
From: Marc-André Lureau <[email protected]>
Validate that the framebuffer stride is at least width * bytes_per_pixel
in both virtio_gpu_scanout_blob_to_fb() and virtio_gpu_do_set_scanout().
A guest can set a very small stride while using a large width. The total
size check (offset + stride * height <= blob_size) passes because
stride * height is small, but pixman reads width * bytes_per_pixel per
row, causing heap OOB reads. The leaked data is rendered to the host
display.
The check is added in virtio_gpu_do_set_scanout() to cover all paths:
blob scanout, non-blob scanout and migration post_load. The additional
early check in virtio_gpu_scanout_blob_to_fb() rejects invalid blob
configurations early.
Fixes: CVE-2026-63109
Fixes: 144bd171c837 ("virtio-gpu: Support blob scanout using dmabuf fd")
I cannot resolve commit 144bd171c837. Apparently the bug was introduced
by commit 7b5574225429 ("hw/display: check frame buffer can hold blob").
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3989
Signed-off-by: Marc-André Lureau <[email protected]>
Reviewed-by: Akihiko Odaki <[email protected]>
