Stack buffer overflow in QEMU e1000e after malformed migration state
Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list:
- From:
Feifan Qian <bea1e@proton.me> - Date:
25 May, 2026 - Message ID:
<7tv587v9DSyRwpybd_eiZtKnGOKrSbEBwtrw0BvXGUMR1u8VS1Cz2IY8COBorkbxt9uuaFumXLVvC64giTlnEI1DaMw5lN2UV3FyGJ-1q8U=@proton.me>
NOTE: the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly.
NOTE: this disclosure includes a report.md file which provides a markdown formatted version of the disclosure which may include more information that this bug description.
I'm writing to report a security vulnerability in QEMU's e1000e device migration and receive handling. The bug was discovered through AI-assisted static code auditing and passed human validation before disclosure.
The issue was reproduced on QEMU 11.0.50, commit f5a24384. The affected code is in the e1000e PCI network device model, specifically the VMState post-load path and the receive descriptor processing path. The vulnerable configuration is a migratable VM exposing e1000e, such as an x86_64 q35 VM with an e1000e device.
This should be treated as a security issue under QEMU's virtualization security model because live migration is an untrusted network protocol, and q35/pc are supported x86 machine types when used with a virtualization accelerator. A malicious migration source can provide device state that the destination QEMU later consumes in the e1000e device model, corrupting host QEMU memory after migration.
The impact is a stack buffer overflow in the destination QEMU process. The proof of concept restores e1000e rx_desc_len as 64, then sends one Ethernet frame; QEMU copies 64 bytes into a 32-byte stack descriptor union in e1000e_write_packet_to_guest(). AddressSanitizer confirms the stack-buffer-overflow and process abort. I rate this as CVSS v3.1 9.8 Critical: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, assuming the destination accepts an attacker-controlled migration stream.
A detailed technical report with full reproduction steps and a proof-of-concept is attached as disclosure.zip. The attached PoC generates valid QEMU migration streams, mutates the e1000e rx_desc_len field, restores the mutated stream through QEMU's real migration path, and triggers the ASan-confirmed overflow through QEMU's socket netdev receive path.
Please let me know if you need additional details, a coordinated disclosure timeline, or validation against a proposed fix.