QEMU fixes eight OOB and overflow bugs in device emulation

Security researcher Tristan Madani has posted fixes for eight out-of-bounds access and overflow bugs in QEMU's emulated display, audio, and SCSI devices. Found by manual source audit, the flaws can let a malicious guest write past heap buffers, read host memory, or stall the emulator's main thread.

The sharpest problems are heap out-of-bounds writes in the ATI Rage128 2D blitter (an integer overflow plus a width-versus-stride mismatch), a TCX blitter source-address check that can disclose host memory past VRAM, and a Gravis Ultrasound 16-bit DMA path that overflows heap and stack buffers. Those fixes are aimed at the stable trees.

Smaller but still guest-reachable issues include missing bounds checks on G364 and SM501 framebuffer and cursor addresses, and an off-by-one in the Artist display VRAM read that can return four bytes of adjacent host heap to the guest. The G364 case is notable for how long it sat open: the draw path already carried an inline comment asking "XXX: out of range in vram?" without ever enforcing a limit against the allocated buffer.

On the storage side, the NCR710 SCRIPTS engine ran guest bytecode with no instruction cap. A JUMP-to-self loop can freeze QEMU indefinitely, the same class of hang previously tracked as CVE-2023-0330 in the LSI53C895A. The fix adopts the same approach used there, yielding after 500 instructions.

The affected backends matter when guests are given older or specialized graphics, audio, or SCSI hardware. With those devices exposed, an untrusted VM could pierce host isolation or deny service until the process is killed.