## Host environment - Operating system: Linux - OS/kernel version: 5.15.0-94-generic #104-Ubuntu SMP (x86_64) - Architecture: x86_64 - QEMU flavor: qemu-system-x86_64 - QEMU version: v11.0.0-2172-gc7cf7c8101 (git master) - QEMU command line: ``` qemu-system-x86_64 -M pc -m 512 -accel tcg -display none \ -device qxl,id=qxl1 -spice port=15900,disable-ticketing=on \ -qmp unix:/tmp/qxl_uaf_qmp.sock,server,nowait ``` ## Emulated/Virtualized environment - Operating system: Linux (guest with iopl(3) or running as PID 1) - Architecture: x86_64 ## Description of problem I used source code analysis for initial discovery and confirmed the bug manually with ASAN and QMP-based reproduction. hw/display/qxl.c:2206: qxl_realize_common() calls qemu_add_vm_change_state_handler() but discards the return value (VMChangeStateEntry*). QXL has no PCIDeviceClass.exit callback, so qemu_del_vm_change_state_handler() is never called. Three bottom halves (update_irq, update_area_bh, cursor_bh) created at qxl.c:2208-2214 are never deleted via qemu_bh_delete(). The entire file contains zero calls to either cleanup function. When a secondary QXL device (dc->hotpluggable = true by default) is hot-unplugged via device_del, the guest responds to the ACPI eject request (port 0xae08), causing pci_config_free() to free PCIDevice.config (pci.c:1210) — a 256-byte region. Later, object_finalize() frees the PCIQXLDevice struct itself. The vm_change_state handler entry remains in vm_change_state_head with a dangling opaque pointer, and the three BH entries retain dangling opaque pointers. On the next VM state change (stop/cont/migrate) or BH dispatch, the callback dereferences freed memory. The dangling handler has two UAF paths depending on the state transition: - cont (running=true, qxl.c:1995): qxl_update_irq() reads d->ram->int_pending/mask and calls pci_set_irq() -> pci_change_irq_level() -> bus->map_irq()/bus->set_irq(), function pointers read from freed PCIDevice.parent_bus. - stop (running=false, qxl.c:1999): qxl_dirty_surfaces() iterates freed guest_slots[].cmds and qxl->ssd fields. The dangling BH entries provide further UAF surfaces: the SPICE server thread can call qxl_send_events() after device removal, which schedules the freed update_irq BH. The mem_reentrancy_guard does not help — it resides inside the freed struct. Confirmed impact: 1. **Denial of service** — ASAN crash confirmed. The QEMU host process aborts on the UAF read. Deterministic — not a race condition. 2. **Information disclosure** — The UAF read path in qxl_update_irq() reads d->ram->int_pending/mask from freed host memory. Since QXL's VRAM is shared with the guest (mmio BAR), a malicious guest can observe host heap contents that are reallocated into the freed QXL device's memory region. 3. **Arbitrary code execution** — The cont-path call chain (qxl_update_irq -> pci_set_irq -> pci_change_irq_level -> bus->set_irq(bus->irq_opaque, irq_num, level)) invokes a function pointer from freed PCIBus memory. The freed heap contents CAN be controlled by the guest through QXL VRAM writes and guest-side heap spray, allowing an attacker to overwrite bus->set_irq with a host function address, overwrite bus->irq_opaque with a command string pointer, and place a fake PCI config space to satisfy pci_intx() and bypass pci_irq_disabled() checks. Confirmed on unmodified QEMU: controlled pointer dereference (the UAF read reaches bus->set_irq from freed memory). Demonstrated with host-side ASLR bypass (reading /proc/PID/maps from the host): the full chain achieves arbitrary command execution in the QEMU host process. A pure guest-to-host escape requires only a host heap address leak to bypass ASLR — the write primitive and control flow hijack work without any host-side access. The exploit is deterministic — the unrealize completes before the next VM state transition dispatches vm_state_notify in the same main loop iteration. Fix: store the VMChangeStateEntry returned by qemu_add_vm_change_state_handler() and add a qxl_exit() callback that deletes the vm_state handler, all three BHs, and the guest_surfaces.cmds allocation before device memory is freed. ASAN output (device_del + guest ACPI eject, built with -O0 -fno-omit-frame-pointer for complete stacks, cont path): ``` ==4183699==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! ================================================================= ==4183699==ERROR: AddressSanitizer: heap-use-after-free on address 0x51100008dfbd at pc 0x562476943a76 bp 0x7fffd15162c0 sp 0x7fffd15162b0 READ of size 1 at 0x51100008dfbd thread T0 #0 0x562476943a75 in pci_get_byte /data/work_space/code/qemu-research/qemu/include/hw/pci/pci.h:880 #1 0x562476943de9 in pci_intx /data/work_space/code/qemu-research/qemu/include/hw/pci/pci_device.h:194 #2 0x56247694ecc5 in pci_set_irq ../hw/pci/pci.c:1877 #3 0x562476dbf80d in qxl_update_irq ../hw/display/qxl.c:1182 #4 0x562476dc5a1e in qxl_vm_change_state_handler ../hw/display/qxl.c:1995 #5 0x562476d50e99 in vm_state_notify ../system/runstate.c:377 #6 0x562476cf2e32 in vm_prepare_start ../system/cpus.c:795 #7 0x562476cf2eb4 in vm_start ../system/cpus.c:802 #8 0x562476405318 in qmp_cont ../monitor/qmp-cmds.c:115 #9 0x5624775adf67 in qmp_marshal_cont qapi/qapi-commands-misc.c:236 #10 0x562477650949 in do_qmp_dispatch_bh ../qapi/qmp-dispatch.c:128 #11 0x5624776b39dd in aio_bh_call ../util/async.c:173 #12 0x5624776b3d8f in aio_bh_poll ../util/async.c:220 #13 0x56247766cda5 in aio_dispatch ../util/aio-posix.c:390 #14 0x5624776b4c6d in aio_ctx_dispatch ../util/async.c:365 #15 0x7fd75e010d3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) #16 0x5624776b860f in glib_pollfds_poll ../util/main-loop.c:290 #17 0x5624776b8782 in os_host_main_loop_wait ../util/main-loop.c:313 #18 0x5624776b8a92 in main_loop_wait ../util/main-loop.c:592 #19 0x562476d52db8 in qemu_main_loop ../system/runstate.c:950 #20 0x5624774d3332 in qemu_default_main ../system/main.c:50 #21 0x5624774d345a in main ../system/main.c:93 #22 0x7fd75bc2fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #23 0x7fd75bc2fe3f in __libc_start_main_impl ../csu/libc-start.c:392 #24 0x5624761d5144 in _start (/data/work_space/code/qemu-research/qemu/build-asan-O0/qemu-system-x86_64+0xb65144) 0x51100008dfbd is located 61 bytes inside of 256-byte region [0x51100008df80,0x51100008e080) freed by thread T3 here: #0 0x7fd75eeb6537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x56247694af1c in pci_config_free ../hw/pci/pci.c:1210 #2 0x56247694b0b7 in do_pci_unregister_device ../hw/pci/pci.c:1220 #3 0x56247694c90f in pci_qdev_unrealize ../hw/pci/pci.c:1488 #4 0x562477165c32 in device_set_realized ../hw/core/qdev.c:603 #5 0x56247717a9c5 in property_set_bool ../qom/object.c:2496 #6 0x562477175c5e in object_property_set ../qom/object.c:1560 #7 0x56247717efea in object_property_set_qobject ../qom/qom-qobject.c:28 #8 0x5624771761dc in object_property_set_bool ../qom/object.c:1630 #9 0x562477164177 in qdev_unrealize ../hw/core/qdev.c:291 #10 0x562476573b38 in acpi_pcihp_device_unplug_cb ../hw/acpi/pcihp.c:331 #11 0x56247656f9de in piix4_device_unplug_cb ../hw/acpi/piix4.c:376 #12 0x56247661dcef in hotplug_handler_unplug ../hw/core/hotplug.c:56 #13 0x562476573249 in acpi_pcihp_eject_slot ../hw/acpi/pcihp.c:218 #14 0x562476574646 in pci_write ../hw/acpi/pcihp.c:472 #15 0x562476d08e1e in memory_region_write_accessor ../system/memory.c:492 #16 0x562476d094aa in access_with_adjusted_size ../system/memory.c:568 #17 0x562476d11a8e in memory_region_dispatch_write ../system/memory.c:1548 #18 0x562476d3c6c0 in address_space_stm_internal ../system/memory_ldst.c.inc:85 #19 0x562476d3ccb5 in address_space_stl_le ../system/memory_ldst_endian.c.inc:53 #20 0x562476f0914d in helper_outl ../target/i386/tcg/system/misc_helper.c:57 #21 0x7fd714e84839 (<unknown module>) previously allocated by thread T0 here: #0 0x7fd75eeb6a57 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 #1 0x7fd75e019c50 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5ec50) #2 0x56247694beb6 in do_pci_register_device ../hw/pci/pci.c:1406 #3 0x562476950656 in pci_qdev_realize ../hw/pci.c:2309 #4 0x562477165463 in device_set_realized ../hw/core/qdev.c:514 #5 0x56247717a9c5 in property_set_bool ../qom/object.c:2496 #6 0x562477175c5e in object_property_set ../qom/object.c:1560 #7 0x56247717efea in object_property_set_qobject ../qom/qom-qobject.c:28 #8 0x5624771761dc in object_property_set_bool ../qom/object.c:1630 #9 0x5624771640ef in qdev_realize ../hw/core/qdev.c:277 #10 0x562476d44a6b in qdev_device_add_from_qdict ../system/qdev-monitor.c:740 #11 0x562476d44b73 in qdev_device_add ../system/qdev-monitor.c:758 #12 0x562476ce0495 in device_init_func ../system/vl.c:1216 #13 0x56247769602a in qemu_opts_foreach ../util/qemu-option.c:1148 #14 0x562476ce761e in qemu_create_cli_devices ../system/vl.c:2756 #15 0x562476ce7acf in qmp_x_exit_preconfig ../system/vl.c:2816 #16 0x562476cec6ae in qemu_init ../system/vl.c:3849 #17 0x5624774d3403 in main ../system/main.c:71 #18 0x7fd75bc2fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: heap-use-after-free /data/work_space/code/qemu-research/qemu/include/hw/pci/pci.h:880 in pci_get_byte ``` Key observations from the stack traces: - READ UAF in pci_get_byte -> pci_intx -> pci_set_irq -> qxl_update_irq (cont path) - Freed by thread T3 (vCPU thread executing guest outl to ACPI eject port): the complete freed-by chain shows guest outl(0xae08) -> ACPI eject -> acpi_pcihp_device_unplug_cb -> qdev_unrealize -> pci_config_free -> freed - This is the device_del attack path: the guest responds to device_del by ejecting via the ACPI hotplug port ## Steps to reproduce 1. Build ASAN-instrumented QEMU with -O0 -fno-omit-frame-pointer for complete stack traces: ``` configure --enable-asan --target-list=x86_64-softmmu \ --extra-cflags='-O0 -fno-omit-frame-pointer -g' && ninja ``` 2. Start QEMU with a Linux guest that has ACPI hotplug support: ``` LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libasan.so.6 \ ASAN_OPTIONS="detect_leaks=0" \ qemu-system-x86_64 -M pc -m 512 -accel tcg -display none \ -device qxl,id=qxl1 -spice port=15900,disable-ticketing=on \ -kernel /path/to/bzImage -initrd /path/to/initramfs.cpio.gz \ -append "console=ttyS0 quiet" \ -qmp unix:/tmp/qxl_uaf_qmp.sock,server,nowait ``` 3. Trigger UAF via QMP after the guest boots (~25s): ``` {"execute": "qmp_capabilities"} {"execute": "device_del", "arguments": {"id": "qxl1"}} # wait ~8s for guest ACPI driver to process eject {"execute": "stop"} {"execute": "cont"} # -> vm_state_notify(true) -> qxl_update_irq on freed qxl -> ASAN crash ``` [qxl_uaf_repro.py](/uploads/b51d5132b3a50a1c41be7037558dd358/qxl_uaf_repro.py)