Disclosure note: This was found during a local QEMU device-audit campaign that used automation, source review, and LLM assistance. I manually triaged the candidate and reproduced the issue with the qtest/ASan evidence below. I am filing it as confidential because it is a host-side QEMU memory-safety issue. ## Summary `scsi-disk` has a MODE SELECT path where a truncated mode page can be allowed by a compatibility quirk, but the parser continues to use the page's declared length rather than the number of bytes actually remaining in the request buffer. In the confirmed case, a guest submits a `MODE_SELECT_10` request through virtio-scsi to a `scsi-cd` device configured with `quirk_mode_page_apple_vendor=true`. The data-out buffer contains many complete audio-control mode pages followed by a final page header that declares a 14-byte body while no body bytes remain. `mode_select_pages()` observes `page_len > len`, permits the truncated page due to the active quirk, and calls `scsi_disk_check_mode_select()` with the declared `page_len`. That helper reads from the page body pointer even though it points at the end of the heap allocation. ## Tested version / environment - QEMU source tree: local upstream tree at commit `20553466cc47af6a8c95f665b601fce3c852e503` - QEMU version reported by build: `11.0.50` - Host: x86_64 Linux - Target binary: x86_64-softmmu ASan build, run through a patched `tests/qtest/qos-test` - Build: x86_64-softmmu with AddressSanitizer and UndefinedBehaviorSanitizer enabled - Machine/device route: `-M pc -device virtio-scsi-pci ... -device scsi-cd,quirk_mode_page_apple_vendor=true` ## Affected code - `hw/scsi/scsi-disk.c:1580-1605`: `mode_select_pages()` parses mode page headers and stores the declared `page_len`. - `hw/scsi/scsi-disk.c:1610-1615`: if `page_len > len`, the function permits the truncated page when `SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED` is active, but does not reduce `page_len` to the available length. - `hw/scsi/scsi-disk.c:1617-1620`: the check pass calls `scsi_disk_check_mode_select(s, page, p, page_len)`. - `hw/scsi/scsi-disk.c:1524-1565`: `scsi_disk_check_mode_select()` compares mode-page bytes using `inbuf[i - 2]` up to the declared length. - `hw/scsi/scsi-disk.c:1625-1626`: after the check, the parser also advances `p`/`len` by the declared `page_len`. - `hw/scsi/scsi-disk.c:1688-1693`: after the MODE SELECT header and block descriptors are removed, the remaining request data is parsed by `mode_select_pages()`. ## Trigger The guest controls the SCSI CDB and data-out payload. The confirmed request uses: - CDB: `MODE_SELECT_10` with PF set and transfer length `4106`; - a 4106-byte data-out buffer; - 256 complete `MODE_PAGE_AUDIO_CTL` pages; - a final `MODE_PAGE_AUDIO_CTL` header with declared body length 14 and zero body bytes remaining. The device configuration used for the confirmed case is: ```text -device scsi-cd,drive=dr1,lun=0,scsi-id=1,quirk_mode_page_apple_vendor=true ``` The quirk condition is important. This report is limited to the path where the truncated-page quirk branch is active. ## Security boundary / triggerability This is triggered by guest-supplied SCSI command data sent to the emulated device. A guest that can issue raw SCSI commands to the affected `scsi-cd` configuration can control the MODE SELECT CDB and data-out buffer. I am filing confidentially because the malformed protocol input is processed by the host QEMU SCSI emulation path and reaches a host heap out-of-bounds read. ## Faulting access The faulting host read is: - `hw/scsi/scsi-disk.c:1561`: `inbuf[i - 2]` inside `scsi_disk_check_mode_select()` For the final truncated page, `inbuf` points exactly at the end of the request data allocation. ## Reproduction Attached reproducer patch: `virtio_scsi_mode_select10_reproducer.patch` The attached patch adds a qtest reproducer; it is not a proposed fix. After applying the patch to a QEMU tree and building with ASan, run the added qtest through Meson, for example: ```sh meson test -C build --setup qtest qtest-x86_64/qos-test ``` The test is added under the virtio-scsi/qos-test path. If you want to run only this case, use Meson's test-name filtering for the added `mode-select-10-truncated-audio-page` case, for example: ```sh meson test -C build --setup qtest qtest-x86_64/qos-test --test-args='-p /x86_64/pc/i440FX-pcihost/pci-bus-pc/pci-bus/virtio-scsi-pci/virtio-scsi/virtio-scsi-tests/mode-select-10-truncated-audio-page' ``` The qtest submits the crafted `MODE_SELECT_10` request through virtio-scsi. The QEMU command line used by the test includes: ```text -M pc -drive id=drv0,if=none,file=null-co://,file.read-zeroes=on,format=raw -device virtio-scsi-pci,id=vs0,addr=04.0 -device scsi-hd,bus=vs0.0,drive=drv0 -drive file=null-co://,file.read-zeroes=on,if=none,id=dr1,format=raw -device scsi-cd,drive=dr1,lun=0,scsi-id=1,quirk_mode_page_apple_vendor=true ``` ## ASan evidence Attached logs: `scsi_mode_select_asan.stderr.txt` and `scsi_mode_select_qtest.stdout.txt` Key ASan result: ```text ERROR: AddressSanitizer: heap-buffer-overflow READ of size 1 #0 scsi_disk_check_mode_select ../hw/scsi/scsi-disk.c:1561 #1 mode_select_pages ../hw/scsi/scsi-disk.c:1620 0x... is located 0 bytes after 4106-byte region SUMMARY: AddressSanitizer: heap-buffer-overflow ../hw/scsi/scsi-disk.c:1561 in scsi_disk_check_mode_select ``` The recorded qtest detected QEMU death from signal 6 after the ASan abort. ## Triage notes - The reproducer reaches the bug through the QEMU virtio-scsi request path, not through a standalone mode-page parser. - The fault address is exactly after a 4106-byte request allocation, avoiding weaker staging-buffer slack cases. - The report is intentionally scoped to `scsi-cd` with an active truncated-page compatibility path. - The declared page length and the actual remaining bytes are both guest-controlled through the MODE SELECT data-out payload. ## Impact A guest with access to the affected SCSI device configuration can trigger a host QEMU heap out-of-bounds read and ASan-detected process abort through a malformed MODE SELECT payload. I have not proven guest-visible disclosure or code execution. ## Suggested fix direction `mode_select_pages()` should keep declared page length separate from available page body length. Possible fixes: - reject truncated mode pages before calling `scsi_disk_check_mode_select()`; - or pass the available length to the check/apply helpers and limit all reads to that available length; - avoid advancing `p` and decrementing `len` by a declared length that exceeds the remaining buffer; - add regression coverage for a final complete page header with declared body length larger than the remaining request data. ## Attachments [virtio_scsi_mode_select10_reproducer.patch](/uploads/d41507a6c4f973bd8f43b4c19b3d77da/virtio_scsi_mode_select10_reproducer.patch) [scsi_mode_select_asan.stderr.txt](/uploads/30fb1be17b6dd6e3ebef48f750aedf36/scsi_mode_select_asan.stderr.txt) [scsi_mode_select_qtest.stdout.txt](/uploads/5453ce3961ad4920c993439c69269a3b/scsi_mode_select_qtest.stdout.txt)