On Thu, 9 Jul 2026, Michael Bommarito wrote: > A malicious Hyper-V host or backend can crash a guest with a short > SYNTH_HID_INITIAL_DEVICE_INFO message. mousevsc_on_receive_device_info() > trusts the HID descriptor bLength and wDescriptorLength without checking > that the received VMBus packet actually contains both byte ranges, so a > truncated packet with an oversized report-descriptor length makes the > guest read past the received packet while copying the descriptor. This > matters most for a confidential guest, where the host is outside the trust > boundary.
Well, untrusted host can crash the (confidential) guest in various other ways. Anyway, the sanitization is good, so I've now applied it. Thanks, -- Jiri Kosina SUSE Labs
