QEMU emulates USB host controllers (UHCI, EHCI, XHCI) and a set of USB devices. The controllers process the guest's transfer descriptors and schedules, and the device models handle guest requests, all in the host QEMU process. Flaws in the controller schedule processing or in a device model corrupt host memory.
USB escape surface:
- Host controllers: UHCI, EHCI, XHCI (transfer descriptor / schedule parsing)
- Emulated device models (HID, storage, serial)
Exploitation notes#
- The XHCI controller, with its richer command and transfer-ring model, is a larger surface than the legacy UHCI and EHCI.
- Reachability requires a USB controller on the guest, which is common; adding a USB device widens the device-model surface.
- The handling runs in the QEMU process, bounded by the host's confinement.