[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 097/108] virtio: out-of-bounds buffer write on inval
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 097/108] virtio: out-of-bounds buffer write on invalid state load |
Date: |
Wed, 6 Aug 2014 15:39:47 -0500 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in
address@hidden/virtio/virtio.c
So we have this code since way back when:
num = qemu_get_be32(f);
for (i = 0; i < num; i++) {
vdev->vq[i].vring.num = qemu_get_be32(f);
array of vqs has size VIRTIO_PCI_QUEUE_MAX, so
on invalid input this will write beyond end of buffer.
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Michael Roth <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit cc45995294b92d95319b4782750a3580cabdbc0c)
Signed-off-by: Michael Roth <address@hidden>
---
hw/virtio/virtio.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 6523e62..d5837c5 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -897,7 +897,8 @@ int virtio_set_features(VirtIODevice *vdev, uint32_t val)
int virtio_load(VirtIODevice *vdev, QEMUFile *f)
{
- int num, i, ret;
+ int i, ret;
+ uint32_t num;
uint32_t features;
uint32_t supported_features;
BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
@@ -928,6 +929,11 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
num = qemu_get_be32(f);
+ if (num > VIRTIO_PCI_QUEUE_MAX) {
+ error_report("Invalid number of PCI queues: 0x%x", num);
+ return -1;
+ }
+
for (i = 0; i < num; i++) {
vdev->vq[i].vring.num = qemu_get_be32(f);
if (k->has_variable_vring_alignment) {
--
1.9.1
- [Qemu-devel] [PATCH 074/108] hw: Consistently name Error ** objects errp, and not err, (continued)
- [Qemu-devel] [PATCH 074/108] hw: Consistently name Error ** objects errp, and not err, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 090/108] nbd: Don't validate from and len in NBD_CMD_DISC., Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 094/108] pc: make isapc and pc-0.10 to pc-0.13 have 1.7.0 memory layout, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 091/108] nbd: Close socket on negotiation failure., Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 095/108] sdhci: Fix misuse of qemu_free_irqs(), Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 092/108] nbd: Shutdown socket before closing., Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 093/108] SMBIOS: Rename symbols to better reflect future use, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 096/108] hw: Fix qemu_allocate_irqs() leaks, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 098/108] virtio: validate config_len on load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 081/108] KVM: Fix GSI number space limit, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 097/108] virtio: out-of-bounds buffer write on invalid state load,
Michael Roth <=
- [Qemu-devel] [PATCH 106/108] vmstate_xhci_event: fix unterminated field list, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 102/108] disas/libvixl: prepend the include path of libvixl header files, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 105/108] kvm-all: Use 'tmpcpu' instead of 'cpu' in sub-looping to avoid 'cpu' be NULL, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 100/108] pci: assign devfn to pci_dev before calling pci_device_iommu_address_space(), Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 108/108] hw/arm/boot: Set PC correctly when loading AArch64 ELF files, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 104/108] cadence_uart: check for serial backend before using it., Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 103/108] s390x/kvm: synchronize guest floating point registers, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 107/108] hw/misc/imx_ccm.c: Add missing VMState list terminator, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 101/108] mc146818rtc: register the clock reset notifier on the right clock, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 099/108] Allow mismatched virtio config-len, Michael Roth, 2014/08/06