A stack-based buffer overflow flaw was found in QEMU's gem_transmit() function.

The gem_transmit() function reads length of packet from physical memory then reads packet from physical memory to tx_packet[2048] with this length. This may result in a buffer overflow if the length of the packet is more than 2048.

Acknowledgements:

Red Hat would like to thank Ling Liu of Qihoo 360 Inc. for reporting this issue.