# \[Security\] lsi53c895a: DMA re-entrancy causes residual underflow and host heap OOB read/write <span dir="">Reporter: \[TaeD\] \[</span><span dir="">kty0730wq@yonsei.ac.kr</span><span dir="">\]\ Disclosure date: 2026-07-26\ Requested embargo: none beyond QEMU's normal confidential triage period</span> ## Tooling disclosure AI assistance was used for source review, experiment design, implementation and refinement of the research harnesses, evidence aggregation, and report drafting. Custom automation was used to launch/restart isolated QEMU victims, drive qtest, connect the booted guest over loopback serial/HMP, hotplug the heap-shaping devices, establish process baselines, perform fail-closed reachability checks, and generate evidence hashes. For the booted-guest impact proof, the host calibration helper used `PROCESS_VM_READ`-equivalent reads only. It identified build-specific heap and CRT addresses and returned them to the guest; it never wrote victim memory. The actual SCSI requests, fake-timer staging, LSI SCRIPTS trigger, OOB read, and OOB write were performed by the Ubuntu guest through PCI configuration, BAR MMIO, and guest physical DMA. Across the booted-guest attempts, HMP automation was used for guest-console key injection during setup, device hotplug for heap shaping, and a read-only status query after the successful trigger; the serial channel replaced host/guest clipboard transfer for calibration data. The results below are artifact-backed observations, not AI-generated or simulated results. The root cause was manually checked against the source, the vulnerable and fixed cases were rerun, and the cited evidence was reviewed before preparing this report. ## Summary A malicious guest controlling an emulated `lsi53c895a` SCSI HBA can make an in-flight SCSI data transfer DMA into the device's own BAR1. This re-enters the LSI SCRIPTS engine and a nested `lsi_do_dma()` on the same `lsi_request`. `lsi_do_dma()` snapshots `count` before the guest-addressed DMA. The nested frame consumes the live request residual first, but the outer frame does not revalidate the current request or re-clamp `count` after the DMA returns. It therefore subtracts a stale value from `p->dma_len`: ```text SCSI DMA allocation 131072 bytes outer count 28 nested consumption 131060 live residual 12 stale outer subtraction 12 - 28 = 0xfffffff0 next p->dma_buf allocation end + 16 ``` The next SCRIPTS block move performs either: - a host heap out-of-bounds read copied to guest physical memory; or - a guest-controlled host heap out-of-bounds write. Both 64-byte primitives at `allocation_end + 16` were reproduced with ASAN. The READ and WRITE each reproduced 3/3 on the vulnerable snapshot and 0/3 on a targeted patched control. A proposed source fix and qtest regression are included. For impact validation, the primitives were also chained in isolated, build-specific research environments: - On Ubuntu/glibc, a release QEMU build with PIE/ASLR executed a benign child command in 2/2 runs and remained alive. The same chain failed on the patched release build. - On Windows QEMU 11.1.0-rc1, the chain overwrote `LSIState.scripts_timer->{cb,opaque}` with `msvcrt!system` and a pointer to `"calc.exe\0"`. Two independent qtest runs created a new Calculator process, observed a direct QEMU child `cmd.exe`, and left the victim QEMU alive. - A booted Ubuntu guest on a Windows PC/i440FX/WHPX `qemu-system-x86_64.exe` victim completed the host-assisted impact chain. It first recovered 4096 host heap bytes through real PCI BAR access and guest physical DMA, staged a complete fake `QEMUTimer` in an in-bounds SCSI buffer, and then used one 8-byte OOB write at offset `+0x870` to redirect `LSIState.scripts_timer`. The timer invoked `msvcrt!system("calc.exe")`; a new `calc.exe` and `CalculatorApp.exe` were recorded, and the victim remained alive with HMP reporting `VM status: running`. The Windows Calculator proof used a read-only host process inspector to calibrate per-process heap and CRT addresses. It is an exploitability proof, not a claim of a portable guest-only exploit. ## Security boundary and attacker requirements - Device: `lsi53c895a`; `lsi53c810` shares the same model - Machines used: `q35` for the minimal qtest paths; QEMU's default PC/i440FX machine with WHPX for the booted Ubuntu guest - Guest capability required: driver-level control of PCI configuration, BAR MMIO, guest physical memory, bus-master DMA, LSI SCRIPTS, and an attached SCSI disk - Host capability required to trigger the memory-safety bug: none - User interaction: none - Boundary crossed: untrusted guest input to host QEMU process memory The minimal qtest reproducer is a harness for the same physical-memory and MMIO operations available to a guest driver. Separately, the complete OOB read/write-to-Calculator chain was reproduced from a booted Ubuntu guest with WHPX. That impact run used a read-only host address oracle and host-orchestrated device hotplug; these are exploit-development aids, not requirements for the underlying memory-safety trigger. ## Affected code and tested versions Affected file: ```text hw/scsi/lsi53c895a.c ``` Tested vulnerable snapshots: | Target | Version / commit | Result | |--------|------------------|--------| | Linux ASAN source build | `5ef0ecc5942ee07bb581cc96a97bbfc0fdf4005c`, VERSION 11.0.90 | READ and WRITE reproduced | | Linux release build | same source pin | benign host command execution 2/2 | | Windows x86 qtest binary | `11.0.91 (v11.1.0-rc1-12127-g1c26c3e070)` | Calculator execution 2 independent qtest runs | | Windows x64 booted-guest binary | same version/build | host-assisted Ubuntu-guest Calculator execution in one confirmed shaped run | Windows victim binary SHA-256: ```text qemu-system-i386.exe ab8866c0f1165dd87ea5a5c37d3197c798b04a4609abf6cf0b7bab8ee9c5d6cf qemu-system-x86_64.exe be6cd95862937216345ac8580fa84939f394076df25936a891169497b570435e ``` The same vulnerable post-DMA sequence was still present in upstream `master` when inspected on 2026-07-26. That observation is source inspection only; the current `master` was not dynamically rebuilt in this environment. The introduction point and complete affected stable-branch range have not been bisected. ## Root cause The vulnerable sequence in `lsi_do_dma()` is: ```c p = s->current; req = scsi_req_ref(s->current->req); count = s->dbc; if (count > p->dma_len) { count = p->dma_len; } /* ... */ if (out) { lsi_mem_read(s, addr, p->dma_buf, count); } else { lsi_mem_write(s, addr, p->dma_buf, count); } if (p->orphan) { scsi_req_unref(req); return; } scsi_req_unref(req); p->dma_len -= count; if (p->dma_len == 0) { p->dma_buf = NULL; scsi_req_continue(req); } else { p->dma_buf += count; lsi_resume_script(s); } ``` The transfer through `lsi_mem_read()` or `lsi_mem_write()` is guest-addressed. When it targets the LSI device's own BAR1, the access is decomposed into ascending byte writes and re-enters `lsi_reg_writeb()`, `lsi_execute_script()`, and then `lsi_do_dma()` on the same request. The nested frame updates `p->dma_len` and `p->dma_buf`. The outer frame's `p->orphan` check only covers request cancellation/completion. It does not detect a changed current request or a residual consumed by a nested frame. Because `p->dma_len` is `uint32_t`, the stale subtraction wraps. The generic memory re-entrancy guard is disabled for the device's `mmio_io` region. The existing LSI SCRIPTS depth limit only limits recursion depth; this trigger needs depth two. This is related to the device self-DMA mechanism involved in CVE-2023-0330, but the failure mode is different. The CVE-2023-0330 recursion-depth mitigation does not validate the mutable SCSI request state across this DMA window. ## Reproducer flow The supplied minimal reproducer: 1. starts `qemu-system-i386` with `q35`, an `lsi53c895a`, and a synthetic `scsi-hd`; 2. programs BAR1 and enables memory decode and bus mastering; 3. issues `TEST UNIT READY` to consume power-on UNIT ATTENTION; 4. issues `READ(10)` for 256 sectors, creating a 131072-byte data-in request; 5. waits for reselection and consumes the IDENTIFY message; 6. performs a 28-byte `PHASE_DI` block move to `BAR1 + 0x14`; 7. the BAR byte sequence stops the outer script and loads a nested DSP; 8. the nested script consumes `131072 - 12` bytes and stops on an interrupt; 9. the outer frame resumes and underflows the residual; 10. a 64-byte data-in probe causes the ASAN OOB READ. For the WRITE variant, the reproducer uses: ```text Set ATN -> PHASE_MO message 0x04 -> lsi_disconnect() -> PHASE_DO block move ``` This retains the corrupted live request and copies 64 guest-controlled bytes through the OOB host pointer. Expected vulnerable READ oracle: ```text ERROR: AddressSanitizer: heap-buffer-overflow READ of size 64 16 bytes after 131072-byte region lsi_do_dma ... hw/scsi/lsi53c895a.c ``` Expected vulnerable WRITE oracle: ```text ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 64 16 bytes after 131072-byte region lsi_do_dma ... hw/scsi/lsi53c895a.c ``` The packaged build/differential commands are recorded in `p7-run-record.md`; concise portable invocation examples are also in the package README. ### Booted Ubuntu guest impact flow The separate `manual-groom-18` run used a real Ubuntu guest rather than qtest: 1. the host bridge hotplugged two PCI bridges with 30 late `lsi53c895a` devices each, creating 60 late timer-bearing objects; 2. the guest kept 121 live 128 KiB SCSI buffers (120 filler allocations plus a dedicated fake-timer staging buffer) to shape and probe the forward heap; 3. the guest triggered the residual underflow and copied a 4096-byte OOB heap window into guest RAM; 4. a read-only host helper located the per-process DMA allocation, `LSIState.scripts_timer`, `msvcrt!system`, committed forward reach, and a suitable filler buffer, then returned those addresses over serial; 5. if the target was not wholly within committed forward memory, the guest aborted without staging the fake timer or issuing an OOB write; 6. in the reachable run, the guest staged the full 48-byte fake `QEMUTimer` with ordinary in-bounds DATA OUT, including `cb = msvcrt!system` and `opaque = &"calc.exe\0"`; 7. the guest issued one 8-byte OOB DATA OUT at `+0x870`, changing only the `scripts_timer` pointer to the staged object, and armed the late LSI timers; 8. Windows recorded new `calc.exe` PID 17412 and `CalculatorApp.exe` PID 9260. A post-run read-only verifier matched the pointer, all 48 fake-timer bytes, and the command string, while QEMU PID 12216 remained alive and running. The guest maps each 0x400-byte BAR1 resource with its physical page offset. This matters because Windows QEMU packed four such resources into one 4 KiB page; omitting the offset addressed only the first controller in each page and prevented most selected timers from being armed. ## Reproduction matrix | Test | Vulnerable | Patched/root-cause control | |------|-----------:|---------------------------:| | Minimal ASAN READ | 3/3 complete oracle | 0/3 | | ASAN WRITE phase pivot | 3/3 complete oracle | 0/3 | | No-self-reentry falsification | no oracle | n/a | | Benign LSI health sequence | pass | pass | | Existing LSI qtests | pass | pass | | New residual-reentrancy qtest | ASAN failure | pass | | Linux release command-execution proof | 2/2 | 0/1; leak buffer unchanged | Windows qtest impact proof: | Result | Run 1 | Run 2 | |--------|------:|------:| | `scripts_timer.cb` changed to `msvcrt!system` | yes | yes | | `scripts_timer.opaque` changed to `"calc.exe\0"` | yes | yes | | direct child of victim QEMU observed | `cmd.exe` | `cmd.exe` | | new Calculator process observed | yes | yes | | victim QEMU alive afterward | yes | yes | Booted Ubuntu guest heap-shaping sample after the BAR1 mapping correction: | Run | Distance / committed reach | Result | |-----|----------------------------|--------| | `manual-groom-16` | `0x14ec0` / `0x13ff0` | safely rejected before fake staging or OOB write | | `manual-groom-17` | `0x503a0` / `0xff0` | safely rejected before fake staging or OOB write | | `manual-groom-18` | `0x870` / `0x58ff0` | full chain; one 8-byte pointer overwrite, Calculator observed, QEMU running | This three-layout sample contains one confirmed success and two fail-closed rejections. It is too small to claim a stable booted-guest success rate and is not combined with the separate qtest statistics. ## Proposed fix Revalidate the request identity and live residual after the re-entrant transfer: ```diff @@ if (p->orphan) { scsi_req_unref(req); return; } + /* + * The transfer above can re-enter this device through its own MMIO BAR. + * Do not apply a pre-transfer snapshot to a different current request, + * and re-clamp against residual state consumed by a nested DMA frame. + */ + if (p != s->current) { + scsi_req_unref(req); + return; + } + if (count > p->dma_len) { + count = p->dma_len; + } scsi_req_unref(req); ``` The supplied patch also adds a qtest that creates a live 128 KiB request and performs the self-BAR residual-reentrancy sequence. On an unpatched ASAN build the regression aborts with the 64-byte OOB READ. On the patched build it passes, the device remains responsive, and its PCI identity is unchanged. ## Impact Demonstrated impact: - guest-readable disclosure of host heap bytes; - guest-controlled corruption of host heap bytes; - crash when a larger OOB transfer reaches an uncommitted/unmapped page; - build-specific control of a QEMU timer callback and benign host process creation in isolated environments. The OOB transfer length and guest physical source/destination are controlled by the guest SCRIPTS instruction. The corrupted host pointer advances forward from the SCSI DMA allocation, so exploitability depends on allocator layout and committed mappings. The Windows qtest chain required out-of-band read-only address calibration and found a forward-reachable timer in 4 of 60 fresh-process qtest layouts (6.7%). The separate booted-guest strategy improved placement with 60 late LSI objects and 121 live SCSI buffers. Of three fresh post-fix layouts, two were safely rejected by the committed-reach check and one completed the Calculator chain. That small sample establishes feasibility but not a stable success rate. These heap-layout and address-oracle limitations should not be read as limitations of the deterministic READ/WRITE memory-safety primitives. ## CWE and provisional severity - CWE-191: Integer Underflow - CWE-125: Out-of-bounds Read - CWE-787: Out-of-bounds Write Provisional CVSS 3.1: ```text CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N = 8.4 High ``` `PR:H` may be preferred if guest-kernel/driver access is treated as high privilege rather than the baseline attacker model for a virtualization escape. Availability is left as `A:N` conservatively. A 1 MiB OOB read also terminated the unsanitized Windows victim, but that DoS result was not repeated in an upstream-source production-build matrix. An `A:H` alternative can therefore be considered during triage. ## Limitations and negative results - The Windows Calculator chain is not a portable guest-only exploit; it used a read-only host address oracle. The booted-guest proof also used HMP device hotplug to shape the heap. - End-to-end Calculator execution was completed in one shaped booted-guest run; a stable success rate has not been measured. - Windows heap placement made the selected direct-callback timer forward-reachable in 4/60 fresh qtest victims. This statistic is independent of the booted-guest fake-timer-pointer strategy. - A patched Windows build was not available. The fixed differential was performed on Linux ASAN and release builds; Windows used a no-reentry falsification control. - The complete affected version range and introducing commit were not bisected. - No privilege escalation, persistence, network access, credential access, or non-benign payload was attempted. ## Suggested attachments 1. `poc_c1_min.py` — minimal READ reproducer 2. `qtest.py` — qtest transport used by the minimal reproducer 3. `p7_poc_write.py` and `p6h3_qtest.py` — WRITE reproducer and its import name 4. `lsi53c895a-residual-reentrancy.patch` — fix and qtest regression 5. `p6-vuln-r1-qemu.log` — representative vulnerable READ ASAN log 6. `p6h3-retry1-vuln-r1-qemu.log` — representative vulnerable WRITE ASAN log 7. `p7-regression-patched-pass.txt` — fixed regression result 8. `p7-run-record.md` — build and differential commands 9. `debugger-callback.txt` — Windows callback overwrite and Calculator proof 10. `guest_lsi_calc.py` — Ubuntu guest PCI/MMIO/DMA impact payload 11. `windows_guest_bridge.py`, `windows_guest_calibrate.py`, and dependencies — read-only address calibration and heap-shaping orchestration 12. `windows_guest_verify.py` — post-run read-only state verifier 13. `guest-manual-18-run-record.md` — privacy-reviewed booted-guest run record 14. `manual-groom-18.bridge.json` and `manual-groom-18.verify.json` — raw calibration/result data and independent post-run comparisons 15. `manual-groom-18.bridge.sanitized.log` — concise bridge transcript with the local user profile path removed 16. `manual-groom-18-calculator-window.png` — cropped Calculator-only evidence ## Artifact hashes ```text Original evidence archive 1e383420ebe9e09585f594def4a31a27dfccedf14ccb2fb84db02e0bfbb13701 Final patch 60b81967d93cad6eb8ca8769f454e6bec4b03a7704acffa040b067b5546b6a0a Pinned vulnerable ASAN qemu-system-i386 a040390218d4bedc2583f110899e625a50b18b24b564c08a961ede76dd20accd Windows qemu-system-i386.exe ab8866c0f1165dd87ea5a5c37d3197c798b04a4609abf6cf0b7bab8ee9c5d6cf Windows qemu-system-x86_64.exe be6cd95862937216345ac8580fa84939f394076df25936a891169497b570435e Booted-guest payload used in manual-groom-18 b21acb4d141f61193e56c078cdbd47bcbeee428f3f16eb5c9dce23c8a5888193 manual-groom-18 bridge result ca93a3015299ed36d4f2cf256a267d90e962f8e8f897ddbba585b3594faa0641 manual-groom-18 cropped Calculator evidence dcf1930e6c773b85ddb52c58382d7832cde379261fc22eabf17b11b0e8d7e5cf Windows callback record 9ec94f3b3c802118ffdab10b0682a482d957b7312fcce2b6ee929faad4a7fda3 ``` ## References - QEMU security process: https://www.qemu.org/contribute/security-process/ - QEMU security boundary: https://www.qemu.org/docs/master/system/security.html - QEMU bug reporting guidance: https://www.qemu.org/contribute/report-a-bug/ - Related prior issue, CVE-2023-0330: https://gitlab.com/qemu-project/qemu/-/issues/1563 [SHA256SUMS](/uploads/464727a4a057c0e62b5cc360724baf88/SHA256SUMS) [manual-groom-18.bridge.json](/uploads/2097416f62a7aa6aebf555b38012065f/manual-groom-18.bridge.json) [manual-groom-18.verify.json](/uploads/4f335079e19fd78b2f780e0172fd9b8e/manual-groom-18.verify.json) {width="251" height="405"} [guest_lsi_calc.py](/uploads/2a3cc92dfc1d47312879a80f76058800/guest_lsi_calc.py) [manual-groom-18.bridge.sanitized.log](/uploads/7ea2386fc6b4cf2f56876c27e688636e/manual-groom-18.bridge.sanitized.log) [guest-manual-18-run-record.md](/uploads/2cb93c5c04ed9fce85cdc9256ccbc22f/guest-manual-18-run-record.md) [p6h3-retry1-vuln-r1-qemu.log](/uploads/03c7e8d1c351e881a3a99fbed600d158/p6h3-retry1-vuln-r1-qemu.log) [p6-vuln-r1-qemu.log](/uploads/bd1cc97f911e2198cffa0c541e1c556c/p6-vuln-r1-qemu.log) [p7_poc_write.py](/uploads/3c8fd459286aae34b2c712fa5c411b8d/p7_poc_write.py) [poc_c1_min.py](/uploads/901c726cd236d887b09177accdc05358/poc_c1_min.py) [debugger-callback.txt](/uploads/a4773c4d12596bf5f09c0b100ec21bc2/debugger-callback.txt) [p7-run-record.md](/uploads/e323b925f636eec2be2f9a0a2ce6940e/p7-run-record.md) [qtest.py](/uploads/28a91ba636a5f06cce3579bd91a12daf/qtest.py)