Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `Brian chastain` * Date: `12 Jun, 2026` * Message ID: `<7977f0af4b58485ca92ed4f6abc010c6cb7fed73.camel@scalingsuccess.io>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. ---- I'm reporting a guest-triggerable heap buffer overflow WRITE in the NVMe device emulation, confirmed under ASAN with a deterministic qtest reproducer and a one-line fix. Sending privately so you can decide on embargo. ## Tooling declaration (per your process) Found with an AI-assisted code-audit tool I wrote (`qemu-audit.py`: it sends whole device modules to an LLM — Claude — with a guest→host trust-boundary prompt and returns ranked *audit leads*). **Every lead was then manually verified against the source and reproduced under AddressSanitizer before this report — nothing here is unverified LLM output.** I also ran libFuzzer (the qtest generic-fuzz harness) against nvme; it did not find this (it requires a specific multi-step admin+I/O command sequence). ## Environment - QEMU upstream master, commit ec6a1f4 (2026-06-11), `--enable-asan --enable-ubsan --cc=clang`. - Host x86_64; guest/machine x86_64 (`-machine pc`). ## The bug In NVM Copy with PRACT, the bounce buffer is sized from the *source* namespace geometry (ctrl.c:3306, `mssrl * sns->lbasz`; no metadata slack when source ms=0), but `nvme_copy_in_completed_cb` generates *destination* PI metadata into it (`nvme_dif_pract_generate_dif`, dif.c:75-95), writing `nlb * dns->lbaf.ms` bytes past the allocation. The `nvme_copy_corresp_pi_match` check (ctrl.c:3148) *explicitly permits* the source-ms=0 / dest-ms=8 configuration that overflows — the allocation simply ignores the dest metadata that PRACT will generate. ## Reachability A privileged guest (CAP_SYS_ADMIN) enables cross-namespace copy format 2 via Set Features (Host Behavior), then issues an NVM Copy with PRACT to a PI-formatted destination namespace, source range referencing a non-PI source. Requires the host to have configured a PI namespace (`ms=8,pi=1`) alongside a non-PI one — not the default QEMU config. ## Primitive / severity Controlled size (`nlb * ms`; measured 1 KB at default mssrl, up to ~512 KB at mssrl=65535, ~1 MB with ms=16) and controlled content (apptag fully attacker-set and unvalidated, reftag attacker-influenced; ~6/8 bytes per 8-byte tuple). DoS demonstrated; code execution plausible. Estimated High, CVSS ~7.5-8.2 (AV:L/PR:H/S:C, Scope:Changed = guest→host); real-world reach gated by the PI-namespace config. Full analysis attached. ## ASAN ``` AddressSanitizer: heap-buffer-overflow WRITE of size 2 ... 0 bytes after a 65536-byte region (mssrl*lbasz = 128*512) #0 nvme_dif_pract_generate_dif hw/nvme/dif.c:87 #1 nvme_copy_in_completed_cb hw/nvme/ctrl.c #2 nvme_copy_in_cb / blk_aio_complete ``` ## QEMU command line (reproducer config) ``` -machine pc -nodefaults \ -drive id=src,if=none,file=null-co://,file.read-zeroes=on,format=raw \ -drive id=dst,if=none,file=null-co://,file.read-zeroes=on,format=raw \ -device nvme,serial=foo,id=nvme0 \ -device nvme-ns,drive=src,bus=nvme0,nsid=1,mssrl=128,mcl=128 \ -device nvme-ns,drive=dst,bus=nvme0,nsid=2,ms=8,pi=1,mssrl=128,mcl=128 ``` Reproducer `tests/qtest/nvme-copy-repro-test.c` (no guest OS needed); a guest-side Python PoC (NVMe passthru ioctl) is attached for the real path. ## Fix (attached: nvme-copy-fix.patch) ```c iocb->bounce = g_malloc_n(le16_to_cpu(sns->id_ns.mssrl), MAX(sns->lbasz + sns->lbaf.ms, dns->lbasz + dns->lbaf.ms)); ``` --- ## Acknowledgment If applicable, please credit: **@ off_by_one / Curious-Keeper** (brian@scalingsuccess.io). Happy to help with retesting. [nvme-copy-repro-test.c](/uploads/7b83589385d9986cbbd392ae4822fbe1/nvme-copy-repro-test.c) [nvme-copy-exploitation-analysis.md](/uploads/5e881e1e0554a9a6f6cc442a30d64f63/nvme-copy-exploitation-analysis.md) [nvme-copy-fix.patch](/uploads/3bf44934172c0c7ce2a9b072c9701098/nvme-copy-fix.patch) [nvme_copy_guest_poc.py](/uploads/624f558cc4ddc1d31f41f1b68202a2aa/nvme_copy_guest_poc.py)