QEMU's storage controllers turn guest disk operations into host I/O, parsing command structures and descriptors from the guest. The AHCI and IDE controllers and the emulated SCSI adapters (the LSI 53c895a and megasas HBAs) have all had memory-corruption flaws in their command and descriptor handling, reachable from a guest that issues crafted storage commands.
Storage escape surface:
- AHCI / IDE command and PRDT handling
- Emulated SCSI HBAs: LSI 53c895a, megasas (command frames)
Exploitation notes#
- The emulated SCSI HBAs have a rich command surface and a history of escapes; the controller model on the guest determines which is reachable.
- Command descriptors and scatter-gather lists are the parsed, attacker-controlled structures.
- virtio-block and virtio-scsi are the paravirtualized alternatives; see virtio devices.