## Host environment - Operating system: Linux - OS/kernel version: Ubuntu 22.04 (kernel 5.15.0-104-generic) - Architecture: x86_64 - QEMU flavor: qemu-system-x86_64 - QEMU version: v11.0.0 and later (git master, commit cc329c4917) - QEMU command line: ``` qemu-system-x86_64 -M q35,cxl=on -m 1024M -nographic -monitor none \ -serial none -accel qtest \ -device pxb-cxl,id=cxl.0,bus=pcie.0,bus_nr=52 \ -M cxl-fmw.0.targets.0=cxl.0,cxl-fmw.0.size=4G \ -device cxl-rp,id=rp0,bus=cxl.0,chassis=0,slot=0 \ -object memory-backend-ram,id=cxl-mem0,size=256M \ -object memory-backend-ram,id=cxl-dc0,size=256M \ -device cxl-type3,bus=rp0,volatile-memdev=cxl-mem0,volatile-dc-memdev=cxl-dc0,num-dc-regions=1,id=mem0 \ -qtest unix:/tmp/cxl_qtest.sock,server,nowait ``` ## Emulated/Virtualized environment - Operating system: N/A (qtest-based, no guest OS required) - Architecture: x86_64 ## Description of problem hw/cxl/cxl-mailbox-utils.c: `cmd_features_set_feature()` processes 8 feature UUID branches for CXL Set Feature (opcode 0502h). The first two (patrol_scrub, ecs) validate `hdr->offset + bytes_to_copy` against `sizeof(wr_attrs)` before memcpy. The remaining six (soft_ppr, hard_ppr, cacheline_sparing, row_sparing, bank_sparing, rank_sparing) perform no bounds check — guest-controlled offset (0-65535) and length (up to 2016 bytes) pass directly to memcpy past the 2-3 byte wr_attrs buffers into adjacent CXLType3Dev fields. This is a partial buffer validation bug: the same check was implemented for some branches but omitted for others. rank_sparing is most critical: `rank_sparing_wr_attrs` is 2 bytes and `dc.host_dc` (HostMemoryBackend pointer) is just 6 bytes beyond it. A guest can overwrite this pointer and trigger its dereference via a subsequent CXL mailbox command. ASAN does not detect this because the OOB write is intra-object — it corrupts adjacent fields within the same large heap allocation (CXLType3Dev is ~7MB), not adjacent heap objects. The behavioral comparison below is the definitive evidence. **Behavioral evidence (qtest):** ``` patrol_scrub (HAS check): offset=0x100 → 0x16 REJECTED soft_ppr (NO check): offset=0x100 → 0x00 SUCCESS hard_ppr (NO check): offset=0x100 → 0x00 SUCCESS rank_sparing (NO check): offset=0x006 → 0x00 SUCCESS (writes past rank_sparing_wr_attrs) ``` **Crash stack trace (release build):** ``` Program terminated with signal SIGSEGV, Segmentation fault. #0 memory_region_size (mr=0x41414141414141b1) at ../system/memory.c:1792 #1 host_memory_backend_mr_inited (backend=0x4141414141414141) at ../backends/hostmem.c:309 #2 host_memory_backend_get_memory (backend=0x4141414141414141) at ../backends/hostmem.c:314 #3 get_dc_size (ct3d=0x7f886233a010) at ../hw/cxl/cxl-mailbox-utils.c:2546 #4 validate_dpa_addr (dpa_addr=268435456, ct3d=0x7f886233a010) at ../hw/cxl/cxl-mailbox-utils.c:2568 #5 media_operations_sanitize (ct3d=0x7f886233a010) at ../hw/cxl/cxl-mailbox-utils.c:2752 #6 cxl_process_cci_message (set=68 'D', cmd=2) at ../hw/cxl/cxl-mailbox-utils.c:4622 #7 mailbox_reg_write at ../hw/cxl/cxl-device-utils.c:209 #8 memory_region_write_accessor at ../system/memory.c:492 #9 access_with_adjusted_size at ../system/memory.c:568 #10 memory_region_dispatch_write at ../system/memory.c:1555 #11 flatview_write_continue_step at ../system/physmem.c:3263 #12 flatview_write_continue at ../system/physmem.c:3293 #13 flatview_write at ../system/physmem.c:3324 #14 address_space_write at ../system/physmem.c:3444 ``` The crash path: guest sends CXL Set Feature with rank_sparing UUID offset=6 → overwrites `dc.host_dc` with controlled value → guest sends MEDIA_OPERATIONS sanitize command → `validate_dpa_addr` calls `get_dc_size` → `host_memory_backend_get_memory` dereferences corrupted pointer → SIGSEGV. **Impact:** 1. **Confirmed (guest-only, no host assistance)**: Controlled pointer dereference in host process → host process crash (DoS). The CXL Set Feature command is guest-accessible via MMIO; no special privileges or host interaction needed. 2. **Confirmed VM escape when combined with Vuln #07 (VirtIO-GPU Rutabaga stack info leak)**: We have demonstrated a pure guest VM escape by combining this CXL OOB write vulnerability with the VirtIO-GPU Rutabaga uninitialized response struct information leak (reported separately as https://gitlab.com/qemu-project/qemu/-/work_items/3609). The Rutabaga vulnerability provides ASLR bypass (leaks host pointer via uninitialized `fence_id` field), and the CXL OOB write provides the write primitive. Together they enable arbitrary host memory read/write and code execution in the QEMU host process — no /proc access, no ptrace, no host-side assistance required. Fix: add `offset + bytes_to_copy > sizeof(wr_attrs)` check to all six unprotected branches, matching the pattern already used for patrol_scrub and ecs. ## Steps to reproduce 1. Build QEMU from source: ``` git clone https://gitlab.com/qemu-project/qemu.git && cd qemu mkdir build && cd build ../configure && ninja ``` 2. Run the behavioral comparison reproducer (ASAN build): ``` ../configure --extra-cflags="-fsanitize=address" && ninja python3 cxl_set_feature_oob_asan.py ``` 3. Expected results: - ASAN build: no ASAN error (intra-object OOB is invisible to ASAN), but behavioral comparison shows patrol_scrub rejects OOB offset while soft_ppr/hard_ppr/rank_sparing accept it - Release build: Set Feature with rank_sparing offset=6 overwrites host_dc; triggering sanitize crashes QEMU with SIGSEGV in `memory_region_size` (see stack trace above) The reproducer script is attached: `cxl_set_feature_oob_asan.py` ## Additional information - Vulnerability introduced in commits 5e5a86bab8 and da5cafdc4d (2025-09-17), first released in v11.0.0 - The corresponding `cmd_features_get_feature()` has proper bounds checking on all 8 branches — the vulnerability is exclusively in the SET direction - Proposed patch: add `offset + bytes_to_copy > sizeof(wr_attrs)` bounds check to all six unprotected branches [fix.patch](/uploads/42eac1409d58eebf075c490e4c2168f8/fix.patch)[cxl_set_feature_oob_asan.py](/uploads/bb79924adf96a2c3fed765da9795d86b/cxl_set_feature_oob_asan.py)