Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `HyungSeok Han <hyungseokhan@microsoft.com>` * Date: `19 Mar, 2026` * Message ID: `<LV8PR21MB40865000F373B884B9CD4EB6D94FA@LV8PR21MB4086.namprd21.prod.outlook.com>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. **NOTE:** this disclosure includes a [report.md](/uploads/59f1c1a912ec8c835f9046e6d4c27853/report.md) file which provides a markdown formatted version of the disclosure which may include more information that this bug description. ---- # Automated tool found this vulnerability LLM discovered this vulnerability and I confirm the POC triggers ASAN. # QEMU version and Env - QEMU version: 5a68a3add61208aad34d47134fdcfd3f407d2ce4 (v11.0.0-rc0) - Host & Guest Arch: x86_64 # Summary `usb-wacom-tablet` trusts the guest's interrupt-IN transfer length when it allocates a temporary heap buffer in `usb_wacom_handle_data()`, but the default HID polling path always writes at least 3 bytes. A guest can therefore submit a 1-byte interrupt-IN URB and trigger a heap-buffer-overflow before QEMU later hits the `usb_packet_copy()` size assertion on non-ASan builds. # Affected code The device descriptor advertises an interrupt-IN endpoint with a max packet size of 8 bytes: - `hw/usb/dev-wacom.c:153-157` However, the xHCI guest is still allowed to request a shorter transfer. In the data path, QEMU allocates exactly `p->iov.size` bytes: - `hw/usb/dev-wacom.c:374-389` ```c g_autofree uint8_t *buf = g_malloc(p->iov.size); ... if (s->mode == WACOM_MODE_HID) { len = usb_mouse_poll(s, buf, p->iov.size); } usb_packet_copy(p, buf, len); ``` After reset, `usb-wacom-tablet` starts in `WACOM_MODE_HID`: - `hw/usb/dev-wacom.c:303-314` In that mode, `usb_mouse_poll()` writes 3 mandatory bytes regardless of `len`, and only checks `len >= 4` for the optional wheel byte: - `hw/usb/dev-wacom.c:228-263` ```c buf[0] = b; buf[1] = dx; buf[2] = dy; l = 3; if (len >= 4) { buf[3] = dz; l = 4; } ``` If the guest submits a 1-byte interrupt-IN URB, `g_malloc(1)` returns a 1-byte heap allocation, and `usb_mouse_poll()` immediately writes past the end of that allocation at `buf[1]` and `buf[2]`. # How to reproduce Attached PoC files: - `poc-usb-wacom-short-int.c` - `poc.sh` 1. Prepare QEMU asan build at `./build-asan/qemu-system-x86_64` 2. Prepare `bzImage` (`~/linux/arch/x86_64/boot/bzImage`) by compiling Linux kernel 3. Run following command ```bash export KERNEL=~/linux/arch/x86_64/boot/bzImage ./poc.sh ./build-asan/qemu-system-x86_64 ./poc-usb-wacom-short-int.c \ -device qemu-xhci,id=xhci \ -device usb-wacom-tablet,bus=xhci.0 ``` # Stack trace ``` ==316389==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000aae231 at pc 0x561708754d05 bp 0x7ffc65f0bd40 sp0 WRITE of size 1 at 0x502000aae231 thread T0 #0 0x561708754d04 in usb_mouse_poll ../hw/usb/dev-wacom.c:256 #1 0x5617087572a8 in usb_wacom_handle_data ../hw/usb/dev-wacom.c:386 #2 0x5617086be2cf in usb_handle_packet ../hw/usb/core.c:438 #3 0x561708736788 in xhci_kick_epctx ../hw/usb/hcd-xhci.c:1922 #4 0x5617098fc11a in timerlist_run_timers ../util/qemu-timer.c:593 #5 0x5617098fcd60 in qemu_clock_run_timers ../util/qemu-timer.c:607 #6 0x5617098fcd60 in qemu_clock_run_all_timers ../util/qemu-timer.c:694 #7 0x5617098e7e44 in main_loop_wait ../util/main-loop.c:603 #8 0x561708a08410 in qemu_main_loop ../system/runstate.c:945 #9 0x56170967ec1f in qemu_default_main ../system/main.c:50 #10 0x561707bed151 in main ../system/main.c:93 #11 0x7fd9b662a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #12 0x7fd9b662a28a in __libc_start_main_impl ../csu/libc-start.c:360 #13 0x561707bf2af4 in _start (/home/hyungseokhan/qemu/build-asan/qemu-system-x86_64+0x2d15af4) (BuildId: b180a8c5722065) 0x502000aae231 is located 0 bytes after 1-byte region [0x502000aae230,0x502000aae231) allocated by thread T0 here: #0 0x7fd9b78fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7fd9b7549ac9 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62ac9) (BuildId: 116e142b9b52c8a4dfd403e759e71a) #2 0x561708756f43 in usb_wacom_handle_data ../hw/usb/dev-wacom.c:374 SUMMARY: AddressSanitizer: heap-buffer-overflow ../hw/usb/dev-wacom.c:256 in usb_mouse_poll Shadow bytes around the buggy address: 0x502000aadf80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x502000aae000: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x502000aae080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x502000aae100: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa 0x502000aae180: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa =>0x502000aae200: fa fa 00 00 fa fa[01]fa fa fa fa fa fa fa fa fa 0x502000aae280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x502000aae300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x502000aae380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x502000aae400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x502000aae480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==316389==ABORTING ``` # Acknowledge HyungSeok Han from Autonomous Code Security Team at Microsoft [poc.sh](/uploads/d29075f40e3bd358e7f4db9bb64381f6/poc.sh) [poc-usb-wacom-short-int.c](/uploads/bbdd4fc3fbf339e63e2057de28031c62/poc-usb-wacom-short-int.c) [report.md](/uploads/59f1c1a912ec8c835f9046e6d4c27853/report.md)