|An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert.
|CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Vulnerable and fixed packages
The table below lists information on source packages.
The information below is based on the following data on fixed versions.
Marked unimportant, as negligible security impact (a privileged guest
can trigger similar issues without triggering the specific assert) and
is disputed by QEMU security team.
Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/ed78352a59ea7acf7520d4d47a96b9911bae7fc3 (v5.0.0-rc0)