0018-virtio-scsi-fix-buffer-overrun-on-invalid-state-load.patch

   1 From 579bb2000dbcd8a415660e76d31f521d87ac1302 Mon Sep 17 00:00:00 2001
   2 From: "Michael S. Tsirkin" <mst@redhat.com>
   3 Date: Thu, 3 Apr 2014 19:52:17 +0300
   4 Subject: [PATCH] virtio-scsi: fix buffer overrun on invalid state load
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2013-4542
  10
  11 hw/scsi/scsi-bus.c invokes load_request.
  12
  13  virtio_scsi_load_request does:
  14     qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
  15
  16 this probably can make elem invalid, for example,
  17 make in_num or out_num huge, then:
  18
  19     virtio_scsi_parse_req(s, vs->cmd_vqs[n], req);
  20
  21 will do:
  22
  23     if (req->elem.out_num > 1) {
  24         qemu_sgl_init_external(req, &req->elem.out_sg[1],
  25                                &req->elem.out_addr[1],
  26                                req->elem.out_num - 1);
  27     } else {
  28         qemu_sgl_init_external(req, &req->elem.in_sg[1],
  29                                &req->elem.in_addr[1],
  30                                req->elem.in_num - 1);
  31     }
  32
  33 and this will access out of array bounds.
  34
  35 Note: this adds security checks within assert calls since
  36 SCSIBusInfo's load_request cannot fail.
  37 For now simply disable builds with NDEBUG - there seems
  38 to be little value in supporting these.
  39
  40 Cc: Andreas Färber <afaerber@suse.de>
  41 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  42 Signed-off-by: Juan Quintela <quintela@redhat.com>
  43 (cherry picked from commit 3c3ce981423e0d6c18af82ee62f1850c2cda5976)
  44 ---
  45  hw/scsi/virtio-scsi.c | 9 +++++++++
  46  1 file changed, 9 insertions(+)
  47
  48 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
  49 index b0d7517..1752193 100644
  50 --- a/hw/scsi/virtio-scsi.c
  51 +++ b/hw/scsi/virtio-scsi.c
  52 @@ -147,6 +147,15 @@ static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
  53      qemu_get_be32s(f, &n);
  54      assert(n < vs->conf.num_queues);
  55      qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
  56 +    /* TODO: add a way for SCSIBusInfo's load_request to fail,
  57 +     * and fail migration instead of asserting here.
  58 +     * When we do, we might be able to re-enable NDEBUG below.
  59 +     */
  60 +#ifdef NDEBUG
  61 +#error building with NDEBUG is not supported
  62 +#endif
  63 +    assert(req->elem.in_num <= ARRAY_SIZE(req->elem.in_sg));
  64 +    assert(req->elem.out_num <= ARRAY_SIZE(req->elem.out_sg));
  65      virtio_scsi_parse_req(s, vs->cmd_vqs[n], req);
  66
  67      scsi_req_ref(sreq);