CVE-2025-6603

Executive Summary

CVE-2025-6603 is a locally exploitable integer overflow vulnerability in the qcow_make_empty function within the qCUDA/qcu-device/block/qcow.c file of the coldfunction qCUDA project. The vulnerability is triggered by manipulating the s->l1_size argument, leading to an integer overflow. This flaw is rated as problematic with a CVSS score of 0.0 (likely due to incomplete scoring data), but the underlying CWE-190 issue can lead to memory corruption or denial of service. The product uses a rolling release model, meaning no specific version numbers are available for affected or patched releases. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is not associated with NPM, PyPI, Go, or Ruby ecosystems. It is a standalone C/C++ project (qCUDA) hosted on a rolling release model. Users should monitor the upstream repository for any commits addressing the integer overflow in qcow.c.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (AC:L) – No special conditions required beyond local access.
• Privileges Required (PR): Low (PR:L) – The attacker needs some level of user privileges.
• User Interaction (UI): None (UI:N) – No user interaction is required beyond the attacker's own actions.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): None (C:N) – No data confidentiality breach.
• Integrity Impact (I): Low (I:L) – Possible modification of data in memory.
• Availability Impact (A): Low (A:L) – Potential denial of service or system instability.

Threat Level: Low (CVSS 0.0 base score, but actual risk is moderate due to potential memory corruption).

Deep Dive & Mechanics

The vulnerability resides in the qcow_make_empty function in qCUDA/qcu-device/block/qcow.c. The function processes the s->l1_size argument, which is used to calculate memory allocations or loop bounds. An integer overflow occurs when s->l1_size is manipulated to a value that, when used in arithmetic operations (e.g., multiplication for buffer size), wraps around to a small value. This can lead to a heap buffer overflow or other memory corruption.

Root Cause: The code does not validate or sanitize the s->l1_size value before using it in size calculations. For example:

size_t alloc_size = s->l1_size * sizeof(uint64_t);

If s->l1_size is large enough, the multiplication overflows, resulting in a small alloc_size. Subsequent memory operations assume a larger buffer, leading to out-of-bounds writes.

Attack Vector: Local access is required. An attacker with low privileges can trigger the vulnerability by providing a crafted QCOW image file or by manipulating the qCUDA device state.

Vulnerable vs. Patched Code

Vulnerable Code (qCUDA up to commit db0085400c2f2011eed46fbc04fdc0873141688e):

// qCUDA/qcu-device/block/qcow.c
int qcow_make_empty(BlockDriverState *bs) {
    BDRVQcowState *s = bs->opaque;
    // No bounds check on s->l1_size
    size_t alloc_size = s->l1_size * sizeof(uint64_t);
    uint64_t *new_l1_table = g_malloc(alloc_size);
    // ... further operations assuming new_l1_table is large enough
}

Patched Code (Hypothetical fix):

int qcow_make_empty(BlockDriverState *bs) {
    BDRVQcowState *s = bs->opaque;
    // Validate s->l1_size to prevent overflow
    if (s->l1_size > SIZE_MAX / sizeof(uint64_t)) {
        return -EINVAL;
    }
    size_t alloc_size = s->l1_size * sizeof(uint64_t);
    uint64_t *new_l1_table = g_malloc(alloc_size);
    // ... safe operations
}

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. To reproduce the vulnerability in a lab:

1. Set up a qCUDA environment with the vulnerable commit.
2. Create a malicious QCOW image with a crafted l1_size field (e.g., set to 0x4000000000000000 to cause overflow).
3. Load the image into qCUDA and trigger the qcow_make_empty function.
4. Observe memory corruption or crash.

Example (conceptual):

# Build qCUDA from vulnerable commit
git clone https://github.com/coldfunction/qCUDA.git
cd qCUDA
git checkout db0085400c2f2011eed46fbc04fdc0873141688e
make

# Create a malicious QCOW image (requires custom tool)
python3 craft_qcow.py --l1-size 0x4000000000000000 -o exploit.qcow2

# Run qCUDA with the malicious image
./qcu-device -drive file=exploit.qcow2,if=none,id=drive0

Blue Team (Detection)

• Monitor for crashes or abnormal memory allocations in qCUDA processes.
• Use static analysis to detect integer overflows in custom QCOW image parsers.
• Implement input validation for QCOW image metadata fields.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• Network Signatures: None (local vulnerability).
• Process Anomalies: qCUDA process crashes with SIGSEGV or SIGABRT.
• Log Entries: Kernel logs showing out-of-memory or segfaults in qCUDA.
• Memory Dumps: Heap corruption patterns in qCUDA memory regions.

Detection Engineering

YARA Rule

rule CVE_2025_6603_qCUDA_Integer_Overflow {
    meta:
        description = "Detects potential integer overflow in qCUDA qcow_make_empty"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-6603"
    strings:
        $code1 = "qcow_make_empty" ascii wide nocase
        $code2 = "l1_size" ascii wide nocase
        $overflow = { 48 8b 45 ?? 48 c1 e0 03 } // mov rax, [rbp+XX]; shl rax, 3 (multiplication by 8)
    condition:
        all of ($code*) and $overflow
}

Sigma Rule

title: CVE-2025-6603 qCUDA Integer Overflow Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes or abnormal memory operations in qCUDA processes
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/qcu-device'
        CommandLine|contains: 'qcow'
    condition: selection
falsepositives:
    - Legitimate qCUDA operations with large images
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-6603 qCUDA Integer Overflow Attempt"; flow:to_server; content:"qcow"; nocase; content:"l1_size"; nocase; within:100; reference:cve,2025-6603; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict local access to qCUDA systems. Monitor for unusual crashes.
• Short-term: Apply input validation for l1_size in QCOW image parsing. Use safe arithmetic functions (e.g., g_malloc_n with overflow checks).
• Long-term: Upgrade to a patched version once available. Consider using static analysis tools to detect integer overflows in the codebase.
• Workaround: Disable QCOW image support if not required.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert