Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `Feifan Qian <bea1e@proton.me>` * Date: `29 May, 2026` * Message ID: `<HopumRg3t48FvwZDJrVk-2Wwj_-LaMpenpp44-mH5PiU8muvfynLnMxWmGCxniXSRkUBf_b1IRN8TiyHJKslKgyc0okZZJX6Tsbw6axMIYk=@proton.me>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. **NOTE:** this disclosure includes a [report.md](/uploads/dacc820a1b850fd46773674af6a27d7d/report.md) file which provides a markdown formatted version of the disclosure which may include more information that this bug description. ---- I'm writing to report a security vulnerability in QEMU's Floppy Disk Controller (FDC) emulation. The bug is in the FIFO write path of fdctrl_write_data() in hw/block/fdc.c and allows a guest to overflow a heap-allocated buffer from within the VM. ## Affected versions: The FDC code in the current master branch (hw/block/fdc.c:2228-2230) is affected. This vulnerability is reachable through the default pc and q35 machine types with no compile-time or runtime configuration required. ## Security rationale: The FDC is a legacy PIO device that accepts command bytes and data from the guest through I/O port 0x3F5. The FIFO is a 512-byte heap-allocated buffer (qemu_memalign(512, 512)) that receives data bytes before they are written to disk. When FORMAT TRACK commands set data_len to values up to 16384 bytes, the write path performs fifo[data_pos % 512] without checking whether data_pos exceeds the FIFO size. This causes writes beyond byte 511 to corrupt adjacent heap memory. The impact crosses the VM-to-host boundary: guest-controlled data can corrupt host process heap objects. This is the same primitive used in CVE-2015-3456 (VENOM), which achieved VM escape through FDC FIFO overflow. Any heap object adjacent to the FIFO containing control-flow metadata (function pointers, vtables, timers) could be corrupted to achieve code execution on the host. A QEMU process crash is also achievable. ## Impact: An attacker who has achieved code execution inside the VM can send FORMAT TRACK commands via PIO port 0x3F5 to overflow the 512-byte FIFO, corrupting adjacent host heap memory. The CVSS score is 8.8 (High), vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The local attack vector reflects that the attacker must first achieve guest code execution; the changed scope reflects that the impact is on the host QEMU process. The vulnerability is triggered by sending a FORMAT TRACK command (0x4D) with a block size code of 0x07 (16384 bytes/sector), then supplying 16384 data bytes via repeated PIO writes to port 0x3F5. Each write overflows the 512-byte FIFO into adjacent heap after byte 511. ## Reproduction note: A detailed technical report with full reproduction steps and a proof-of-concept program is attached as disclosure.zip. The vulnerability code path is confirmed in the source: the FIFO is allocated with 512 bytes (qemu_memalign) at hw/block/fdc.c:2366, data_len can be set to 16384 via FORMAT TRACK at lines 1957-1958, and the write operation at lines 2228-2230 performs fifo[data_pos % 512] with no bounds check on data_pos. When run against a QEMU binary built with AddressSanitizer, the expected output is a heap-buffer-overflow report at fdctrl_write_data in hw/block/fdc.c, with the write occurring 512 bytes past the allocated FIFO region. [report.md](/uploads/dacc820a1b850fd46773674af6a27d7d/report.md) [disclosure.zip](/uploads/fe44fd0996f475acb0f35839d750d1d7/disclosure.zip)