An OOB read access issue was found in the MegaRAID SAS 8708EM2 emulator of the QEMU. It occurs in 'megasas_lookup_frame' routine when 's->reply_queue_head' is set to a malicious value. A guest user/process may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Name: Ren Ding (SSLab Georgia Tech), Hanqing Zhao (SSLab Georgia Tech), Alexander Bulekov
Created qemu tracking bugs for this issue:
Affects: fedora-all [bug 1841000]
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):