QEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoA manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoA ones-tensor repro shows an out-of-bounds global load in the GPU prefix-sum path once the length exceeds roughly a billion floats.
By tensorBefore 9.2.1013, huge terminal resize requests updated state but not clamped screen storage, so later output could write past the buffer.
By tarpitReplacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
By kexecAuthenticated clients could force undersized ACL headers or heap out-of-bounds reads via crafted security descriptors.
By oops