CyberRota Analysis
AI-GeneratedA type mismatch vulnerability in QEMU's vhost inflight migration VMState handling allows an attacker to exploit a crafted migration state, potentially leading to a crash or memory corruption of the QEMU process. This issue arises from the improper handling of buffer sizes, which can cause data to be copied beyond allocated memory bounds. Organizations using QEMU with vhost inflight migration should prioritize addressing this vulnerability, especially those with control over migration channels.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.