Executive brief
The SUSE Virtual Machine Driver Pack, which provides optimized drivers for Windows virtual machines running on SUSE Linux Enterprise, contains a flaw in how it handles configuration data. An attacker with the ability to modify system registry settings could potentially cause a driver malfunction or memory corruption. While this could impact the integrity of the driver, there is currently no known practical way to exploit this for a full system takeover.
Technical details
A classic buffer overflow (CWE-120) exists in the SUSE Virtual Machine Driver Pack (VMDP) due to the use of the `RtlQueryRegistryValues` function with the `RTL_QUERY_REGISTRY_DIRECT` flag but without proper type checking. An attacker who can modify the Windows registry can provide malformed input that overflows a buffer when the driver loads its configuration. This could lead to an arbitrary write primitive in kernel space, though the vendor notes no currently feasible exploit path. The issue was addressed by adding the `RTL_QUERY_REGISTRY_TYPECHECK` flag in version 2.5.5.1.
Affected products
- SUSE Virtual Machine Driver Pack (VMDP) before v2.5.5.1 (commit e7a602ec232756ead019bdf19d6d3b9d010cc94b)
Timeline
- 2025-09-12: disclosed: Reported by University of Milan researchers
- 2026-05-28: patched: Version 2.5.5.1 released on GitHub
- 2026-07-14: advisory: NVD publication date