From: Aleksandr Mogylchenko Date: Tue, 4 Aug 2015 17:18:25 +0000 (+0300) Subject: QEMU vulnerability (CVE-2015-5154) patches X-Git-Url: https://review.fuel-infra.org/gitweb?a=commitdiff_plain;h=f216a5aced89d20b5f0e8744421ea25a7fa59aff;p=packages%2Fcentos6%2Fqemu.git QEMU vulnerability (CVE-2015-5154) patches Change-Id: I6e4f89d86a4a7e134795ac728c289587a052f2b0 Closes-Bug: #1479898 --- diff --git a/CVE-2015-5154.patch b/CVE-2015-5154.patch new file mode 100644 index 0000000..40da1e5 --- /dev/null +++ b/CVE-2015-5154.patch @@ -0,0 +1,78 @@ +From d2ff85854512574e7209f295e87b0835d5b032c6 Mon Sep 17 00:00:00 2001 +From: Kevin Wolf +Date: Sun, 26 Jul 2015 23:42:53 -0400 +Subject: [PATCH] ide: Check array bounds before writing to io_buffer (CVE-2015-5154) + +If the end_transfer_func of a command is called because enough data has +been read or written for the current PIO transfer, and it fails to +correctly call the command completion functions, the DRQ bit in the +status register and s->end_transfer_func may remain set. This allows the +guest to access further bytes in s->io_buffer beyond s->data_end, and +eventually overflowing the io_buffer. + +One case where this currently happens is emulation of the ATAPI command +START STOP UNIT. + +This patch fixes the problem by adding explicit array bounds checks +before accessing the buffer instead of relying on end_transfer_func to +function correctly. + +Cc: qemu-stable@nongnu.org +Signed-off-by: Kevin Wolf +Reviewed-by: John Snow +--- + hw/ide/core.c | 16 ++++++++++++++++ + 1 files changed, 16 insertions(+), 0 deletions(-) + +diff --git a/hw/ide/core.c b/hw/ide/core.c +index 122e955..44fcc23 100644 +--- a/hw/ide/core.c ++++ b/hw/ide/core.c +@@ -2021,6 +2021,10 @@ void ide_data_writew(void *opaque, uint32_t addr, uint32_t val) + } + + p = s->data_ptr; ++ if (p + 2 > s->data_end) { ++ return; ++ } ++ + *(uint16_t *)p = le16_to_cpu(val); + p += 2; + s->data_ptr = p; +@@ -2042,6 +2046,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr) + } + + p = s->data_ptr; ++ if (p + 2 > s->data_end) { ++ return 0; ++ } ++ + ret = cpu_to_le16(*(uint16_t *)p); + p += 2; + s->data_ptr = p; +@@ -2063,6 +2071,10 @@ void ide_data_writel(void *opaque, uint32_t addr, uint32_t val) + } + + p = s->data_ptr; ++ if (p + 4 > s->data_end) { ++ return; ++ } ++ + *(uint32_t *)p = le32_to_cpu(val); + p += 4; + s->data_ptr = p; +@@ -2084,6 +2096,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr) + } + + p = s->data_ptr; ++ if (p + 4 > s->data_end) { ++ return 0; ++ } ++ + ret = cpu_to_le32(*(uint32_t *)p); + p += 4; + s->data_ptr = p; +-- +1.7.0.4 + + diff --git a/Clear-DRQ-after-handling-all-expected-accesses.patch b/Clear-DRQ-after-handling-all-expected-accesses.patch new file mode 100644 index 0000000..aae93b2 --- /dev/null +++ b/Clear-DRQ-after-handling-all-expected-accesses.patch @@ -0,0 +1,71 @@ +From cb72cba83021fa42719e73a5249c12096a4d1cfc Mon Sep 17 00:00:00 2001 +From: Kevin Wolf +Date: Sun, 26 Jul 2015 23:42:53 -0400 +Subject: [PATCH] ide: Clear DRQ after handling all expected accesses + +This is additional hardening against an end_transfer_func that fails to +clear the DRQ status bit. The bit must be unset as soon as the PIO +transfer has completed, so it's better to do this in a central place +instead of duplicating the code in all commands (and forgetting it in +some). + +Signed-off-by: Kevin Wolf +Reviewed-by: John Snow +--- + hw/ide/core.c | 16 ++++++++++++---- + 1 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/hw/ide/core.c b/hw/ide/core.c +index 44fcc23..50449ca 100644 +--- a/hw/ide/core.c ++++ b/hw/ide/core.c +@@ -2028,8 +2028,10 @@ void ide_data_writew(void *opaque, uint32_t addr, uint32_t val) + *(uint16_t *)p = le16_to_cpu(val); + p += 2; + s->data_ptr = p; +- if (p >= s->data_end) ++ if (p >= s->data_end) { ++ s->status &= ~DRQ_STAT; + s->end_transfer_func(s); ++ } + } + + uint32_t ide_data_readw(void *opaque, uint32_t addr) +@@ -2053,8 +2055,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr) + ret = cpu_to_le16(*(uint16_t *)p); + p += 2; + s->data_ptr = p; +- if (p >= s->data_end) ++ if (p >= s->data_end) { ++ s->status &= ~DRQ_STAT; + s->end_transfer_func(s); ++ } + return ret; + } + +@@ -2078,8 +2082,10 @@ void ide_data_writel(void *opaque, uint32_t addr, uint32_t val) + *(uint32_t *)p = le32_to_cpu(val); + p += 4; + s->data_ptr = p; +- if (p >= s->data_end) ++ if (p >= s->data_end) { ++ s->status &= ~DRQ_STAT; + s->end_transfer_func(s); ++ } + } + + uint32_t ide_data_readl(void *opaque, uint32_t addr) +@@ -2103,8 +2109,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr) + ret = cpu_to_le32(*(uint32_t *)p); + p += 4; + s->data_ptr = p; +- if (p >= s->data_end) ++ if (p >= s->data_end) { ++ s->status &= ~DRQ_STAT; + s->end_transfer_func(s); ++ } + return ret; + } + +-- +1.7.0.4 diff --git a/Fix-START-STOP-UNIT-command-completion.patch b/Fix-START-STOP-UNIT-command-completion.patch new file mode 100644 index 0000000..1e07b8c --- /dev/null +++ b/Fix-START-STOP-UNIT-command-completion.patch @@ -0,0 +1,28 @@ +From 03441c3a4a42beb25460dd11592539030337d0f8 Mon Sep 17 00:00:00 2001 +From: Kevin Wolf +Date: Sun, 26 Jul 2015 23:42:53 -0400 +Subject: [PATCH] ide/atapi: Fix START STOP UNIT command completion + +The command must be completed on all code paths. START STOP UNIT with +pwrcnd set should succeed without doing anything. + +Signed-off-by: Kevin Wolf +Reviewed-by: John Snow +--- + hw/ide/atapi.c | 1 + + 1 files changed, 1 insertions(+), 0 deletions(-) + +diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c +index 950e311..79dd167 100644 +--- a/hw/ide/atapi.c ++++ b/hw/ide/atapi.c +@@ -983,6 +983,7 @@ static void cmd_start_stop_unit(IDEState *s, uint8_t* buf) + + if (pwrcnd) { + /* eject/load only happens for power condition == 0 */ ++ ide_atapi_cmd_ok(s); + return; + } + +-- +1.7.0.4 diff --git a/qemu.spec b/qemu.spec index ddbee04..d3aa240 100644 --- a/qemu.spec +++ b/qemu.spec @@ -221,6 +221,12 @@ Patch0022: 0022-openpic-avoid-buffer-overrun-on-incoming-migration.patch Patch0023: 0023-virtio-net-out-of-bounds-buffer-write-on-load.patch Patch0024: 0024-virtio-validate-config_len-on-load.patch +#CVE-2015-5154 related patches. See more information here: +#https://bugzilla.redhat.com/show_bug.cgi?id=1243563 +Patch0080: CVE-2015-5154.patch +Patch0081: Clear-DRQ-after-handling-all-expected-accesses.patch +Patch0082: Fix-START-STOP-UNIT-command-completion.patch + BuildRequires: SDL-devel BuildRequires: zlib-devel BuildRequires: which @@ -768,7 +774,9 @@ CAC emulation development files. %patch0022 -p1 %patch0023 -p1 %patch0024 -p1 - +%patch0080 -p1 +%patch0081 -p1 +%patch0082 -p1 %build %if %{with kvmonly}