On Wed, Aug 26, 2026 at 08:17:23PM +0200, Paolo Bonzini wrote: > A guest with an attached scsi-hd can force QEMU's SCSI disk emulation > to read roughly 60 KiB past the end of a heap buffer, copying that out > of bounds host memory into the guest's own disk image. > > This is due to a race between WRITE SAME and an obscure MODE SELECT > feature which can be restricted to the Q800 machine. > > Paolo > > Paolo Bonzini (2): > scsi-disk: fix out-of-bound read in WRITE SAME > scsi: hide MODE SELECT block size change behind a quirk > > include/hw/scsi/scsi.h | 1 + > hw/m68k/q800.c | 2 ++ > hw/scsi/scsi-disk.c | 17 +++++++++++++---- > 3 files changed, 16 insertions(+), 4 deletions(-) > > -- > 2.55.0 > >
Reviewed-by: Stefan Hajnoczi <[email protected]>
signature.asc
Description: PGP signature
