Logic is in place to avoid writes to certain host config space
fields when the guest must nevertheless be able to access their
virtual counterparts. A bug in how this logic deals with accesses
spanning multiple fields allows the guest to write to the host MSI
message data field.
While generally the writes write back the values previously read,
their value in config space may have got changed by the host between
the qemu read and write. In such a case host side interrupt handling
could become confused, possibly losing interrupts or allowing
spurious interrupt injection into other guests.
Certain untrusted guest administrators may be able to confuse host
side interrupt handling, leading to a Denial of Service.