A guest with an attached scsi-hd can force QEMU's SCSI disk emulation to read roughly 60 KiB past the end of a heap buffer, copying that out of bounds host memory into the guest's own disk image.
This is due to a race between WRITE SAME and an obscure MODE SELECT feature which can be restricted to the Q800 machine. Paolo Paolo Bonzini (2): scsi-disk: fix out-of-bound read in WRITE SAME scsi: hide MODE SELECT block size change behind a quirk include/hw/scsi/scsi.h | 1 + hw/m68k/q800.c | 2 ++ hw/scsi/scsi-disk.c | 17 +++++++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-) -- 2.55.0
