Vishnu Dev T. J., a third-year security enthusiast, from team bi0s, the academic ethical hacking team of Amrita Vishwa Vidyapeetham, Amritapuri Campus, discovered a security bug in QEMU which can be triggered by sending specially crafted network packet and can lead to fatal full system compromise.

QEMU (Quick EMUlator) is a free and open-source emulator that performs hardware virtualization. On reporting the bug, he was issued with a Common Vulnerability Exposure id CVE-2020-7039 which is a heap buffer overflow in the network backend of QEMU (SLiRP). This bug can be weaponized to create Denial of Service (DoS) attack or get remote code execution (RCE) on the host system.

Exploiting such bug enables an attacker to extract sensitive information from the host or other VM running on the same host. The bug was found through code review and was reported to Red Hat.