On Thu, 9 Jul 2026, Michael Bommarito wrote:
A malicious Hyper-V host or backend can crash a guest with a short
SYNTH_HID_INITIAL_DEVICE_INFO message. mousevsc_on_receive_device_info()
trusts the HID descriptor bLength and wDescriptorLength without checking
that the received VMBus packet actually contains both byte ranges, so a
truncated packet with an oversized report-descriptor length makes the
guest read past the received packet while copying the descriptor. This
matters most for a confidential guest, where the host is outside the trust
boundary.
Well, untrusted host can crash the (confidential) guest in various other
ways.
Anyway, the sanitization is good, so I've now applied it.
Thanks,
--
Jiri Kosina
SUSE Labs