CVE-2014-9718

What it actually does

The flaw stems from inconsistent return-value handling in bmdma_prepare_buf and ahci_dma_prepare_buf, allowing a guest-supplied PRDT with zero complete sectors to trigger unbounded memory allocation or infinite loops inside the host QEMU process.

Why it matters to the business

A compromised or malicious guest can render the host unavailable, disrupting all VMs on that host; the issue is confined to long-obsolete QEMU releases and carries negligible current risk.

How an attack unfolds

An attacker who already controls a guest VM constructs a PRDT descriptor list indicating zero sectors, then initiates a BMDMA or AHCI transfer; the host DMA-preparation routines misinterpret the return value, loop or allocate excessively, and crash the QEMU process.

How to fix it

Upgrade QEMU to any release after 2.1.3. Organizations using the Chainguard dynamic-localpv-provisioner-fips package must move to version 3.5.0-r0 or newer.

How to confirm the fix worked

Confirm the running QEMU binary reports a version greater than 2.1.3; re-execute any available DMA-preparation unit tests with a zero-sector PRDT to verify the crash path is closed.

Typical attack path

1. Obtain code execution inside a guest VM
2. Allocate and populate a PRDT structure with zero complete sectors
3. Issue an IDE DMA command through BMDMA or AHCI registers
4. Trigger the flawed prepare_buf path and exhaust host resources

How to detect it

Correlate guest-initiated IDE DMA commands with sudden QEMU memory growth or CPU spin; examine process accounting and hypervisor logs for repeated bmdma_prepare_buf or ahci_dma_prepare_buf calls that never complete.

What your security team should do

• Inventory all hosts running QEMU <= 2.1.3 and schedule immediate upgrades
• Apply the Chainguard package update to 3.5.0-r0 where that build is deployed
• Harden guest isolation and limit DMA exposure until patches are applied