Details of the critical vulnerability () in the SLIRP handler, which is by default used in QEMU to establish a communication channel between the virtual network adapter in the guest system and the network backend on the QEMU side. The issue also affects virtualization systems based on KVM (in the ) and VirtualBox, which use the slirp backend from QEMU, as well as applications that utilize the user space network stack (TCP/IP emulator).
The vulnerability allows for code execution on the host system with the permissions of the QEMU process handler when a specially crafted very large network packet is sent from the guest system, which requires fragmentation. Due to an error in the ip_reass() function invoked during the reassembly of incoming packets, the first fragment may not fit in the allocated buffer, and its tail will be written to the memory areas following the buffer.
To test an already A working exploit prototype has been developed that includes bypassing ASLR and executing code via overwriting the memory of the main_loop_tlg array, which includes the QEMUTimerList with handlers triggered by timer events.
The vulnerability has already been fixed in and , but remains unresolved in , and . In and The issue does not manifest due to the lack of slirp usage. The vulnerability remains unpatched in the latest release of (the fix is currently available as ).
Source: opennet.ru
