Executive brief
virtio-win provides Windows drivers for virtual devices running under QEMU and KVM. The Viosock driver incorrectly validates file descriptor counts when processing socket selection requests, allowing a low-privilege user to trigger an integer overflow. This overflow bypasses bounds checking and causes the driver to write beyond allocated kernel memory, potentially leading to privilege escalation on the guest system.
Technical details
The vulnerability exists in the VIOSockSelect function of the Viosock driver (versions mm210 to mm320), where attacker-controlled fd_count values in VIRTIO_VSOCK_SELECT.Fdss arrays are summed with 32-bit arithmetic. An attacker can craft a tuple (e.g., 0xFFFFFFFE + 0x40 + 0x02) that wraps the sum to pass both zero and FD_SETSIZE bounds checks. VIOSockSelectCopyFds then uses the unchecked count to iterate and write beyond the pPkt->Fds array in kernel heap, enabling memory corruption and privilege escalation. The fix validates each individual fd_count before summing to prevent overflow.
Affected products
- Red Hat virtio-win mm210 to mm319
Timeline
- 2026-09-18: disclosed
- 2026-06-01: patched: Fix merged in commit c6bef93