On 2026-08-05 13:50, Marc-André Lureau wrote:
ccid_bulk_in_get() decrements bulk_in_pending_num when a slot becomes active, but the slot is only truly free after ccid_bulk_in_release(). A guest can fill all 8 ring slots, partially read one (leaving pos non-zero), then send another command whose response reuses the active slot. The stale pos > new len makes the uint32_t subtraction in ccid_bulk_in_copy_to_guest() wrap, reading past data[].Move the decrement to ccid_bulk_in_release() so the slot stays busy until then. Add an assert(pos <= len) before the subtraction. In practice, the device advertises bMaxCCIDBusySlots=1, so a conforming host never has more than one command in flight and the ring never fills. Fixes: CVE-2026-18204 Fixes: 367071447ec5 ("usb-ccid: add CCID bus") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4086 Reported-by: Warisjeet Singh <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- hw/usb/dev-smartcard-reader.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
See my comments on previous version: https://lore.kernel.org/qemu-devel/[email protected]/
