From: Haotian Jiang <jianghaotian.sunday@gmail.com>

This issue was found by Tencent Security Yunding Lab during CXL
emulation security research, and reported by Haotian Jiang
<jianghaotian.sunday@gmail.com>.

cxl_doe_cdat_rsp() in hw/mem/cxl_type3.c:280-282 (Type3) and
hw/pci-bridge/cxl_upstream.c:160-162 (USP) takes
ent = req->entry_handle (uint16_t, fully guest-controlled, 0..0xFFFF)
and directly indexes cdat->entry[ent] without checking
ent < cdat->entry_len. For a default cxl-type3 with one volatile
memory region, entry_len = 7, so any entry_handle >= 7 reads past
the CDATEntry array into host heap.

The OOB-read base/length is then used in
memcpy(read_mbox + offset, base, len) at cxl_type3.c:298-299, leaking
host heap memory to the guest via PCI_EXP_DOE_RD_DATA_MBOX, and
potentially overflowing the 1 MiB read_mbox heap buffer when the OOB
length field is large.

Per QEMU's security policy (docs/system/security.rst), CXL is
classified as non-virtualization use case, so this is reported as a
normal bug rather than through the security process.

A qtest-based PoC (poc.py) is available for reproduction. Under ASAN
it reports SEGV in cxl_doe_cdat_rsp at cxl_type3.c:281.

Haotian Jiang (1):
  hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle

 hw/mem/cxl_type3.c           | 3 +++
 hw/pci-bridge/cxl_upstream.c | 3 +++
 2 files changed, 6 insertions(+)

-- 
2.34.1