Heap Out-of-Bounds Read in Parallels Format-Extension Parsing

Heap Out-of-Bounds Read in Parallels Format-Extension Parsing

Disclosure Status

Potential security issue. Please initially treat this report as confidential while assessing whether the affected file-open path is in QEMU's security boundary and whether CVE assignment is appropriate.

Automated analysis was used to identify the candidate. The report was then validated with an ASan-instrumented build of QEMU's real qemu-img binary and a checksum-valid Parallels image.

Summary

Opening a crafted Parallels image with:

qemu-img info -f parallels parallels-extension-cursor.img

causes an AddressSanitizer heap-buffer-overflow read in parallels_read_format_extension. The parser advances its cursor over a feature payload without reducing the corresponding remaining byte budget. Consequently, a subsequent loop iteration accepts and copies another feature header after the cursor has reached the end of the allocated extension cluster.

Affected Component

  • Function: parallels_read_format_extension
  • File: block/parallels-ext.c
  • Reproduced revision: 6333226c2abb72f31648c251624c56e70993d625
  • Reproduced copy: memcpy(&fh, pos, sizeof(fh)); at line 234 in that revision
  • Current upstream source checked: the same copy remains at line 250 in the checked master revision

The affected parser path was introduced by upstream commit baefd977002e72402f2cc42b11f2cb11b96aae9e (parallels: support bitmap extension for read-only mode, 2021-02-24). It is present in v6.0.0-rc0 and therefore certainly in v6.0.0.

Root Cause

The extension parser allocates one cluster and tracks the current pointer in pos plus the remaining byte budget in remaining.

After reading a feature header, it subtracts sizeof(fh) from remaining and validates fh.data_size <= remaining. For a recognized dirty-bitmap feature, it then advances pos over the aligned payload:

pos = ext_cluster + QEMU_ALIGN_UP(pos + fh.data_size - ext_cluster, 8);

It does not subtract the payload length or alignment padding from remaining. A valid feature can thus advance pos exactly to the end of the extension cluster while remaining still permits another feature-header read. The next iteration performs memcpy(&fh, pos, sizeof(fh)) beyond the allocation.

Reproducer

Please attach the individual file parallels-extension-cursor.img to the confidential issue. Its SHA-256 is:

4eb734d0d0fd65e3c600121911893d1a7829d443e7bdfe31330e6fef2273933c

The fixture is 1024 bytes and has a valid extension checksum. Build qemu-img from revision 6333226c2abb72f31648c251624c56e70993d625 with AddressSanitizer enabled, then run:

ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 \
  qemu-img info -f parallels parallels-extension-cursor.img

The original validation used an offline, read-only-input build and invocation. The target binary was built with clang 18.1.3 and QEMU's --enable-asan configuration option.

Observed Result

The real qemu-img binary aborts with:

ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 8
0 bytes after 512-byte region

Offline symbol resolution identifies the top QEMU frame as parallels_read_format_extension; the inlined checked copy resolves to block/parallels-ext.c:234 in the reproduced revision. The caller is parallels_open.

Impact and Scope

Confirmed: a user or application that opens an attacker-controlled Parallels image through qemu-img can trigger a heap out-of-bounds read and process abort in the real QEMU parser.

Not established:

  • Code execution, a write primitive, information disclosure, or privilege escalation.
  • Guest-to-host, network, or remote reachability.
  • That a deployment accepts an attacker-controlled Parallels image on a path covered by QEMU's virtualization security boundary.
  • The complete affected or fixed-version range, or downstream backport status.

Please evaluate the report under QEMU's security policy. If this file-open path is not eligible for security triage, it should still be handled as a parser correctness and hardening bug.

History and Duplicate Search

The following bounded review did not identify an exact public duplicate, stable-backport fix, or advisory for this format-extension cursor-accounting primitive:

  • QEMU upstream history affecting block/parallels-ext.c
  • Public QEMU bugs and advisories
  • Public CVE/advisory records for the Parallels driver

Nearest distinct items include CVE-2014-0143 (catalog-size integer overflow in block/parallels.c), CVE-2014-0142 (a s->tracks validation issue in block/parallels.c), and commit 58607752d173438994d28dea7e2c2587726663e6 (an ext_off overflow/assertion fix in block/parallels.c).

Duplicate and CVE-history closure remain incomplete.

Suggested Fix Direction

When advancing pos over the feature payload, account for the same payload length and alignment padding in remaining, or derive all bounds checks from the cursor's distance to the end of the extension cluster. A regression test should include a checksum-valid extension whose first valid feature consumes the remaining payload area and is followed without an end feature.

Reporter Checklist

  • Mark the GitLab issue confidential before submission.
  • Include the issue description above and attach the fixture directly, not in an archive.
  • Keep the SHA-256 alongside the attachment.
  • Do not claim a CVE, severity, or virtualization-boundary impact before QEMU maintenance triage.

No external report, issue, advisory request, or submission was sent.