CVE-2015-7549

What it actually does

Failure to define the .write method for MSI-X MMIO regions in QEMU's hw/pci/msix.c results in a NULL pointer dereference when a privileged guest writes to the region, crashing the QEMU process.

Why it matters to the business

Virtual machines running on affected QEMU hosts can be terminated from inside the guest, causing unplanned downtime and loss of service availability for workloads that depend on those VMs.

How an attack unfolds

An attacker with administrative access inside a guest VM crafts an MSI-X configuration or performs a memory write to an uninitialized MSI-X MMIO BAR; because no .write handler exists, QEMU dereferences a NULL pointer and terminates, ending the VM.

How to fix it

Upgrade QEMU to a version that supplies the missing .write handler for all MSI-X MMIO regions; apply vendor backports if running older releases; disable unnecessary PCI device passthrough or MSI-X features where feasible.

How to confirm the fix worked

Confirm the QEMU binary no longer crashes when a test guest performs writes to MSI-X MMIO regions; review source or binary for presence of a non-NULL .write callback in msix.c; re-test after applying updates.

Typical attack path

1. Obtain privileged access inside a guest VM
2. Configure or access an MSI-X capable PCI device whose MMIO region lacks a .write method
3. Issue a memory write to the affected MSI-X region
4. Trigger NULL pointer dereference and QEMU process crash

How to detect it

Search hypervisor logs and QEMU stderr/stdout for segmentation faults or NULL pointer dereference messages immediately preceding VM termination; correlate guest administrative logins with sudden VM crashes.

What your security team should do

• Prioritize patching QEMU hosts that expose MSI-X capable devices to untrusted guests
• Monitor for guest-initiated QEMU crashes and correlate with VM availability alerts
• Review hypervisor configurations to limit MSI-X exposure for high-value workloads