## Host environment - Operating system: Ubuntu 24.04.4 LTS - OS/kernel version: Linux 6.6.87.2-microsoft-standard-WSL2 - Architecture: x86_64 - QEMU flavor: qemu-system-x86_64 - QEMU version: QEMU emulator version 11.0.50 - QEMU command line: ``` ./qemu-system-x86_64 \ -M pc -m 512M -accel kvm -no-reboot \ -nographic -serial stdio -monitor none \ -drive file=noble-server-cloudimg-amd64.img,format=qcow2,if=virtio \ -drive file=seed.iso,format=raw,if=virtio \ -nic user,model=e1000,hostfwd=tcp::2222-:22 \ -device gus,audiodev=audio0 -audiodev id=audio0,driver=none ``` ## Emulated/Virtualized environment - Operating system: Ubuntu 24.04.3 LTS - OS/kernel version: Linux 6.8.0-90-generic - Architecture: x86_64 ## Description of problem The bug is in `hw/audio/gus.c:GUS_read_DMA()`. `GUS_read_DMA()` declares a scratch buffer as: ```c QEMU_UNINITIALIZED char tmpbuf[4096]; ``` It then calls the ISA DMA backend: ```c copied = k->read_memory(s->isa_dma, nchan, tmpbuf, pos, to_copy); gus_dma_transferdata(&s->emu, tmpbuf, copied, left == copied); ``` When the guest programs the i8257 controller into verify mode, `hw/dma/i8257.c:i8257_dma_read_memory()` returns `len` without touching the destination buffer: ```c if (i8257_is_verify_transfer(r)) { return len; } ``` As a result: 1. The guest programs DMA channel 3 into verify mode. 2. The guest triggers a GUS DMA read (`func 0x41`, `DREQ=1`). 3. `GUS_read_DMA()` receives `copied > 0` even though `tmpbuf` was never initialized. 4. `gus_dma_transferdata()` copies those uninitialized stack bytes into GUS DRAM (`himem`). 5. The guest reads the leaked bytes back through the DRAM access port (`0x347`). Impact: a guest can disclose QEMU process stack contents, including pointers and stack canary. (After testing, I was able to reliably obtain the PIE base, libc base, and stack canary) ## Steps to reproduce Build poc.c as shown below and then run it as root inside the guest: ```sh gcc -o poc poc.c -static ``` [poc.c](/uploads/6956553dcf4147c99e11b669aa65b57a/poc.c) ## Additional information Below is the suggested patch. ```diff diff --git a/hw/audio/gus.c b/hw/audio/gus.c index 196c4f7..1f3c5a1 100644 --- a/hw/audio/gus.c +++ b/hw/audio/gus.c @@ -185,7 +185,7 @@ static int GUS_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len) { GUSState *s = opaque; IsaDmaClass *k = ISADMA_GET_CLASS(s->isa_dma); - QEMU_UNINITIALIZED char tmpbuf[4096]; + char tmpbuf[4096] = { 0 }; int pos = dma_pos, mode, left = dma_len - dma_pos; ``` The screenshot below shows the PoC being executed inside the guest. {width="443" height="600"}