CVE-2017-16845

What it actually does

Failure to validate rptr and count fields in PS/2 device state during guest migration allows out-of-bounds memory access in the QEMU process.

Why it matters to the business

Attackers could crash virtual machines or read and write arbitrary host memory, risking data exposure or denial of service for any organization relying on QEMU-based virtualization.

How an attack unfolds

An attacker with network access to a migration endpoint supplies a malicious PS/2 device state that contains invalid rptr and count values; when migration occurs, QEMU performs an out-of-bounds access that can be leveraged for memory corruption.

How to fix it

Upgrade QEMU to a version that enforces bounds checking on rptr and count during PS/2 state loading; apply vendor patches for Debian and Ubuntu packages once available.

How to confirm the fix worked

Confirm the installed QEMU binary contains the upstream fix that validates rptr and count before accessing the PS/2 ring buffer; re-test migration with known-bad state values to verify rejection.

Typical attack path

1. Identify a QEMU instance accepting incoming migrations
2. Craft a PS/2 device state blob containing out-of-range rptr and count values
3. Initiate or intercept a live migration that processes the malicious state
4. Trigger the out-of-bounds read or write to corrupt memory or cause a crash

How to detect it

Review QEMU migration logs and core dumps for PS/2 ring-buffer access violations; correlate with network flows that carry migration data containing suspicious device state.

What your security team should do

• Prioritize patching all QEMU hosts that perform live migration
• Disable or restrict migration interfaces until patches are applied
• Monitor for unusual migration traffic and PS/2 device state anomalies