An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

qemu-2.6.1-1.5 on GA media

qemu: virtio-net: buffer overflow on invalid state load qemu: virtio: out-of-bounds buffer write on invalid state load qemu: virtio: insufficient validation of num_sg when mapping qemu: virtio: insufficient validation of num_sg when mapping qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load qemu: virtio-scsi: buffer overrun on invalid state load qemu: virtio: buffer overrun on incoming migration qemu: crash by possible division by zero Qemu: block: multiple integer overflow flaws Qemu: block: missing input validation Qemu: prevent possible buffer overflows Qemu: qcow2: NULL dereference in qcow2_open() error path Qemu: block: possible crash due signed types or logic error Qemu: vhdx: bounds checking for block_size and logical_sector_size qemu: virtio-net: buffer overflow in virtio_net_handle_mac() function qemu: virtio: out-of-bounds buffer write on state load with invalid config_len QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART Qemu: usb: fix up post load checks

Affected: Ubuntu:14.04:LTS: qemu

An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.