{"id":170807,"date":"2026-05-16T06:24:35","date_gmt":"2026-05-16T04:24:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy"},"modified":"2026-05-16T06:24:35","modified_gmt":"2026-05-16T04:24:35","slug":"qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/qemutiny-uyazvimosti-v-qemu-pozvolyayushhie-poluchit-dostup-k-host-okruzheniyu-iz-gostevoj-sistemy","title":{"rendered":"QEMUtiny \u2014 vulnerabilities in QEMU that allow access to the host environment from the guest system.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers recently discovered the Fragnesia vulnerability in the Linux kernel and published information about vulnerabilities in QEMU, which allow gaining root access to the host environment from a guest system. This issue has been assigned the codename QEMUtiny, but a CVE identifier has not yet been assigned. An exploit has been prepared that involves two vulnerabilities in the CXL (Compute Express Link) device emulation code. <\/p>\n
Both vulnerabilities are present in the code cxl-mailbox-utils.c. The first vulnerability appears starting from the release of QEMU 7.1.0 and leads to reading memory from outside the allocated buffer because the function cmd_logs_get_log() mistakenly interprets the requested offset of the CEL log as an index in the array, whereas it is specified in bytes. The second vulnerability occurs starting from QEMU 11.0.0 and results in a buffer overflow in the function cmd_features_set_feature() due to processing offsets in structures when writing attributes without checking that the calculated value of \"offset + bytes_to_copy\" fits within the size of the selected structure. <\/p>\n
In fact, the attack is only possible on the latest branch of QEMU 11.0.0. There is currently no information on a fix, only that before the vulnerability was disclosed, the information was passed to the QEMU developers, who responded that support for the CXL device in QEMU is not implemented for use in virtualization. <\/p>\n
The exploit has been tested with the QEMU codebase from May 11, with the latest commit 5e61afe. The exploit's operation is tied to the layout of structures in the memory of each specific QEMU build and the system's libc, but according to the researchers, by leveraging the vulnerability that allows reading from outside the buffer for memory scanning, a universal exploit can be created that works with different versions of QEMU. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"