A privileged guest can program an out-of-layout Virtio 1.x `queue_avail`
address for the `vioscsi` device and then notify the queue. The host-side
`vioscsi` device process dereferences a pointer derived from the unchecked
offset and terminates with `SIGSEGV`.
from Quarkslab
ok hshoexer, mlarkin
A privileged guest can notify an invalid virtio-scsi queue index. The
host-side `vioscsi` device process uses the guest-controlled value as an array
index without a bounds check, interprets adjacent process memory as virtqueue
metadata, and terminates with `SIGSEGV`.
from Quarkslab
ok hshoexer, mlarkin
Do not call `fatalx()` on malformed guest-provided descriptor lengths. Reject
the request and return without terminating the VM process.
from Quarkslab
ok hshoexer, mlarkin
A privileged guest can notify one invalid virtio-block queue index and
terminate the host-side `vioblk` device process. In the confirmed run, this
also caused the VM event thread to exit unexpectedly.
from Quarkslab
ok hshoexer, mlarkin
A privileged guest can make the host-side `vioblk` backend read a descriptor
outside the configured virtqueue descriptor table and interpret the out-of-table
entry as a block request descriptor. In the confirmed run, the guest-controlled
out-of-table descriptor made `vmd(8)` read and log a guest-chosen block command
value, and the device entered `DEVICE_NEEDS_RESET`.
from Quarkslab
ok hshoexer, mlarkin
