| Field | Value | |-------|-------| | Product | QEMU 11.0.1 (and master HEAD) | | Component | hw/usb/dev-uas.c | | CWE | CWE-787 (Out-of-bounds Write) / CWE-125 (Out-of-bounds Read) | | CVSS 3.1 | 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) | | Auth Required | Guest VM user (low privilege) | | Verified at | master HEAD (2026-06-26) | ## Summary In QEMU's USB Attached SCSI (UAS) device emulation, the `usb_uas_command()` function in `hw/usb/dev-uas.c` has three error paths that use a guest-supplied stream tag without bounds validation. The tag is a `uint16_t` (range 0-65535) but indexes arrays sized for only 17 entries (`UAS_MAX_STREAMS + 1 = 17`). This results in a heap out-of-bounds read (up to 524KB past the array) and a heap out-of-bounds write (zeroing 8 bytes at a controlled offset). ## Vulnerable Code The UAS device maintains two arrays indexed by stream tag: ```c // hw/usb/dev-uas.c, line 109-110 #define UAS_STREAM_BM_ATTR 4 #define UAS_MAX_STREAMS (1 << UAS_STREAM_BM_ATTR) // = 16 // hw/usb/dev-uas.c, line 134-135 USBPacket *data3[UAS_MAX_STREAMS + 1]; // [17] -- indices 0-16 USBPacket *status3[UAS_MAX_STREAMS + 1]; // [17] -- indices 0-16 ``` Tags are validated at line 708, BUT three error paths jump BEFORE this check: ```c // hw/usb/dev-uas.c, line 696-755 static void usb_uas_command(UASDevice *uas, uas_iu *iu) { uint16_t tag = be16_to_cpu(iu->hdr.tag); // guest-controlled, 0-65535 size_t cdb_len = sizeof(iu->command.cdb) + iu->command.add_cdb_length; // PATH 1: add_cdb_length > 0 jumps BEFORE bounds check if (iu->command.add_cdb_length > 0) { goto unsupported_len; // <-- BEFORE tag check } // Tag bounds check -- NOT reached by Path 1 if (uas_using_streams(uas) && tag > UAS_MAX_STREAMS) { goto invalid_tag; // line 708-709 } // ... unsupported_len: usb_uas_queue_fake_sense(uas, tag, ...); // tag=65535, unchecked invalid_tag: usb_uas_queue_fake_sense(uas, tag, ...); // PATH 2: uses OOB tag } ``` `usb_uas_queue_fake_sense()` calls `usb_uas_alloc_status()` which stores the tag: ```c // line 344-354 static UASStatus *usb_uas_alloc_status(UASDevice *uas, uint8_t id, uint16_t tag) { UASStatus *st = g_new0(UASStatus, 1); st->status.hdr.tag = cpu_to_be16(tag); if (uas_using_streams(uas)) { st->stream = tag; // stream = 65535 } return st; } ``` Then `usb_uas_queue_status()` performs the OOB read: ```c // line 384-387 static void usb_uas_queue_status(UASDevice *uas, UASStatus *st, int length) { USBPacket *p = uas_using_streams(uas) ? uas->status3[st->stream] : uas->status2; // OOB READ: status3[65535] ``` And `usb_uas_send_status_bh()` performs the OOB write: ```c // line 363-366 while ((st = QTAILQ_FIRST(&uas->results)) != NULL) { if (uas_using_streams(uas)) { p = uas->status3[st->stream]; // OOB READ: status3[65535] uas->status3[st->stream] = NULL; // OOB WRITE: zeroes 8 bytes } ``` ## Data Flow 1. Guest sends USB UAS COMMAND IU with `add_cdb_length > 0` and `tag = 65535` 2. `usb_uas_command()` jumps to `unsupported_len` BEFORE the `tag > UAS_MAX_STREAMS` check at line 708 3. `usb_uas_queue_fake_sense(uas, 65535, ...)` is called 4. `usb_uas_alloc_status()` stores `st->stream = 65535` 5. `usb_uas_queue_status()` reads `uas->status3[65535]` -- heap OOB read at offset `(65535 - 16) * 8 = 524,152 bytes` 6. `usb_uas_send_status_bh()` writes `uas->status3[65535] = NULL` -- heap OOB write (zeroes 8 bytes at same offset) ## Impact - **OOB Read**: If the heap memory at the computed offset happens to contain a non-NULL pointer, QEMU dereferences it as a `USBPacket*` and calls `usb_packet_copy()` and `usb_packet_complete()` on it -- following virtual method pointers. With heap grooming, this is a code execution primitive. - **OOB Write**: Zeroes 8 bytes at a controlled offset up to 524KB past the UASDevice struct on the heap. Can corrupt heap metadata or adjacent object state. - **Scope Change**: The bug runs in the QEMU host process. Exploitation from a guest VM achieves VM escape (guest-to-host code execution). ## Attack Scenario 1. Attacker configures a QEMU VM with a USB UAS device in SuperSpeed mode (common for USB 3.0 storage passthrough) 2. From inside the guest, the attacker crafts a UAS COMMAND IU with `add_cdb_length = 1` and `tag = 65535` 3. The error path is triggered, leading to OOB array access 4. With heap grooming (placing controlled data at the right offset), the OOB read returns a fake `USBPacket*` pointer, achieving code execution in the host process ## Affected Configurations Any QEMU VM with a USB UAS device in SuperSpeed mode. The `usb-uas` device must be attached to an xHCI controller (USB 3.0) for streams to be active (`uas_using_streams()` returns true). ## Comparison with Correct Code The STATUS and DATA pipe handlers correctly validate the stream tag: ```c // line 843 (STATUS pipe) if (p->stream > UAS_MAX_STREAMS) { return; } // line 873 (DATA pipe) if (p->stream > UAS_MAX_STREAMS) { return; } ``` Only the COMMAND/TASK error paths lack this validation.