Executive brief
libslirp is a networking library used by virtualization software like QEMU to provide internet access to guest virtual machines. A flaw in how it handles specific network signals (TCP urgent data) allows a user inside a virtual machine to read sensitive information from the host computer's memory. This could lead to the exposure of gigabytes of data from the host process or other virtual machines, potentially including encryption keys or private communications.
Technical details
A vulnerability exists in the `sosendoob` function within `socket.c` of libslirp due to insufficient validation of the TCP urgent pointer (`ti_urp`). An attacker with `CAP_NET_RAW` or root privileges within a guest VM can send crafted TCP segments with manipulated URG flags to inflate the `so_urgc` counter beyond the actual data present in the receive buffer (`sb_cc`). This results in an out-of-bounds read of the `sb_data` heap allocation. Furthermore, a subsequent integer underflow of `sb_cc` allows the attacker to leak up to 4GiB of host-process heap memory, which may contain sensitive data from other slirp sessions or the hypervisor itself. The issue is fixed in version 4.9.2 by capping the urgent data count to the amount of data actually available.
Affected products
- freedesktop.org libslirp before v4.9.2
- QEMU QEMU All versions using slirp user-mode networking
Timeline
- 2026-05-23: patched: Fix authored in libslirp repository
- 2026-06-24: disclosed: CVE-2026-9539 published