Bug 2513527

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The inflight destination buffer size is stored as a uint64_t field, but the VMS_VBUFFER load path reads it as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative, which is then converted to a very large size_t. QEMU may then copy migration-stream data beyond the mmap-backed destination inflight region, resulting in a destination QEMU process crash or memory corruption.

Exploitation requires control of the migration producer or write access to the migration channel, combined with a configuration using vhost inflight migration.