An out-of-bounds read was reported in sd.c allowing privileged user in guest to cause kernel DoS.

Vulnerable code:

//qemu/hw/sd/sd.c
static sd_rsp_type_t sd_normal_command(SDState *sd,
SDRequest req)
{
uint32_t rca = 0x0000;
uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 :
req.arg;

/* Not interpreting this as an app command */
sd->card_status &= ~APP_CMD;

//here!! sd_cmd_type is an array of 64 bytes,but req.cmd can be a value
from 0 to 0xff, so sd_cmd_type[req.cmd] could be make a out-of-bounds read
issue.
if (sd_cmd_type[req.cmd] == sd_ac || sd_cmd_type[req.cmd] == sd_adtc)
rca = req.arg >> 16;

...
}