Buffer overflow in the SCSI implementation in QEMU as used in Xen when a SCSI controller has more than 256 attached devices allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.