An out-of-bounds r/w access issue was found in the USB OHCI controller emulator of QEMU. It could occur while servicing transfer descriptors(TD), as OHCI controller derives variables 'start_addr', 'end_addr', 'len' etc. from values supplied by the host controller driver. Host controller driver may supply values such that using above variables leads to out-of-bounds access issues. A guest user/process may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Name: Gaoning Pan (Zhejiang university), Yongkang Jia (Zhejiang university), Yi Ren (Alibaba Cloud Intelligence Security Team)
Created qemu tracking bugs for this issue:
Affects: fedora-all [bug 1879802]
Created xen tracking bugs for this issue:
Affects: fedora-all [bug 1879803]