[Qemu-commits] [qemu/qemu] 0be839: migration: fix parameter validation on ram load

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 0be839a2701369f669532ea5884c15bead1c6e08
      
https://github.com/qemu/qemu/commit/0be839a2701369f669532ea5884c15bead1c6e08
  Author: Michael S. Tsirkin <address@hidden>
  Date:   2014-11-18 (Tue, 18 Nov 2014)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  migration: fix parameter validation on ram load

During migration, the values read from migration stream during ram load
are not validated. Especially offset in host_from_stream_offset() and
also the length of the writes in the callers of said function.

To fix this, we need to make sure that the [offset, offset + length]
range fits into one of the allocated memory regions.

Validating addr < len should be sufficient since data seems to always be
managed in TARGET_PAGE_SIZE chunks.

Fixes: CVE-2014-7840

Note: follow-up patches add extra checks on each block->host access.

Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
Signed-off-by: Amit Shah <address@hidden>


  Commit: ea5b201a0acfb4c3029afd4e7999b4278e1351d4
      
https://github.com/qemu/qemu/commit/ea5b201a0acfb4c3029afd4e7999b4278e1351d4
  Author: Peter Maydell <address@hidden>
  Date:   2014-11-18 (Tue, 18 Nov 2014)

  Changed paths:
    M arch_init.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/amit-migration/tags/for-2.2' into 
staging

Fix for CVE-2014-7840, avoiding arbitrary qemu memory overwrite for
migration by Michael S. Tsirkin.

# gpg: Signature made Tue 18 Nov 2014 11:23:00 GMT using RSA key ID 854083B6
# gpg: Good signature from "Amit Shah <address@hidden>"
# gpg:                 aka "Amit Shah <address@hidden>"
# gpg:                 aka "Amit Shah <address@hidden>"

* remotes/amit-migration/tags/for-2.2:
  migration: fix parameter validation on ram load

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/444b1996cb37...ea5b201a0acf