CVE-2022-3872: 
NixOS vulnerability analysis and mitigation

An off-by-one read/write vulnerability (CVE-2022-3872) was discovered in the SDHCI device of QEMU versions through 7.1.0:rc4. The vulnerability occurs when reading/writing the Buffer Data Port Register in sdhcireaddataport and sdhciwritedataport functions, specifically when datacount equals blocksize (Debian Security).

The vulnerability is related to buffer access in the SDHCI (SD Host Controller Interface) implementation. The issue specifically manifests when accessing the Buffer Data Port Register through the sdhcireaddataport and sdhciwritedataport functions. The condition occurs when the datacount variable equals the blocksize, leading to an off-by-one error in buffer access. The vulnerability has received a CVSS score of 8.6 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (NetApp Security).

A successful exploitation of this vulnerability could allow a malicious guest to crash the QEMU process on the host, resulting in a denial of service (DoS) condition (Debian Security).

A patch has been proposed to fix the vulnerability by ensuring that datacount is reset if it equals or exceeds blocksize. The fix involves modifying the sdhcibuffaccessissequential function to include this check (QEMU Patch).