Researchers recently discovered the Fragnesia vulnerability in the Linux kernel and published information about vulnerabilities in QEMU, which allow gaining root access to the host environment from a guest system. This issue has been assigned the codename QEMUtiny, but a CVE identifier has not yet been assigned. An exploit has been prepared that involves two vulnerabilities in the CXL (Compute Express Link) device emulation code.
Both vulnerabilities are present in the cxl-mailbox-utils.c code. The first vulnerability manifests starting from QEMU version 7.1.0 and leads to reading memory from outside the allocated buffer due to the cmd_logs_get_log() function incorrectly interpreting the requested offset of the CEL log as an index in the array, while it is specified in bytes. The second vulnerability appears from QEMU version 11.0.0 and leads to a buffer overflow in the cmd_features_set_feature() function due to handling offsets in structures when writing attributes without checking that the computed value 'offset + bytes_to_copy' fits within the size of the selected structure.
In fact, the attack is only possible on the latest branch of QEMU 11.0.0. There is currently no information on a fix, only that before the vulnerability was disclosed, the information was passed to the QEMU developers, who responded that support for the CXL device in QEMU is not implemented for use in virtualization.
The exploit has been tested with the QEMU codebase from May 11, with the latest commit 5e61afe. The exploit's operation is tied to the layout of structures in the memory of each specific QEMU build and the system's libc, but according to the researchers, by leveraging the vulnerability that allows reading from outside the buffer for memory scanning, a universal exploit can be created that works with different versions of QEMU.
Source: opennet.ru
