On Friday, 12 June 2026 20:22:52 CEST Christian Schoenebeck wrote:
> Feifan Qian reported a potential DoS and unbound host allocation via
> Treaddir request due to msize not being capped on Tversion handshake, and
> allocation size in Treaddir being capped too late.
>
> Attack Vector of Vulnerability:
>
> A malicious guest can negotiate a large 9P msize during Tversion handshake
> and then send Treaddir request with a large 'count' parameter. The 9p
> server would allocate host memory proportional to the negotiated 'msize'
> for collecting directory entries, before validating that the actual reply
> buffer can hold the response. If the reply buffer is smaller than what was
> allocated, the response marshalling fails, but the memory has already been
> consumed.
>
> This can lead to:
>
> - Unbound host memory allocation proportional to the negotiated msize.
> - Denial of service against the QEMU process.
> - Potential OOM conditions affecting entire host system.
>
> This series fixes this vulnerability on two layers.
Queued on 9p.next:
https://github.com/cschoenebeck/qemu/commits/9p.next
Thanks!
/Christian
> Summary of patches fixing this vulnerability:
>
> - Layer 1: Patches 1..4 cap msize during Tversion handshake to reasonable
> maximum value. It does so by limiting msize to the theoretical maximum
> msize value supported by transport implementation.
>
> - Layer 2: Patches 5..8 cap the allocated host memory in the Treaddir
> handler specifically to the current, real response buffer size of transport
> implementation.
>
> v2:
> - Patch 3:
> - Pick the smallest limit from all Xen rings.
> - Return zero if Xen's ring count is zero.
> - Patch 7:
> - Use a local iovec in_sg[2] array variable to avoid potential NULL
> pointer dereference.
> - Patch 8:
> - Fix potential underflow if response_buffer_size() returned a value
> smaller than 11.
>
> Christian Schoenebeck (8):
> hw/9pfs: add msize_limit transport callback
> 9pfs/virtio: implement msize_limit callback
> 9pfs/xen: implement msize_limit callback
> hw/9pfs: cap negotiated msize to transport limit
> hw/9pfs: add response_buffer_size transport callback
> 9pfs/virtio: implement response_buffer_size callback
> 9pfs/xen: implement response_buffer_size callback
> hw/9pfs: cap Treaddir allocation (CVE-2026-9238)
>
> hw/9pfs/9p.c | 34 ++++++++++++++++++++++++++++++++--
> hw/9pfs/9p.h | 2 ++
> hw/9pfs/virtio-9p-device.c | 17 +++++++++++++++++
> hw/9pfs/xen-9p-backend.c | 31 +++++++++++++++++++++++++++++++
> 4 files changed, 82 insertions(+), 2 deletions(-)