qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] virtio-blk: refuse SG_IO requests with scsi=off


From: Paolo Bonzini
Subject: Re: [Qemu-devel] [PATCH] virtio-blk: refuse SG_IO requests with scsi=off
Date: Fri, 13 Jan 2012 16:56:17 +0100
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111222 Thunderbird/9.0

On 01/05/2012 11:05 AM, Paolo Bonzini wrote:
On 12/23/2011 03:39 PM, Paolo Bonzini wrote:
QEMU does have a "scsi" option (to be used like -device
virtio-blk-pci,drive=foo,scsi=off). However, it only
masks the feature bit, and does not reject the command
if a malicious guest disregards the feature bits and
issues a request.

Without this patch, using scsi=off does not protect you
from CVE-2011-4127.

Signed-off-by: Paolo Bonzini<address@hidden>
---
hw/virtio-blk.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index b70d116..6cd3164 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -153,6 +153,12 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq
*req)
int status;
int i;

+ if ((req->dev->vdev.guest_features& (1<< VIRTIO_BLK_F_SCSI)) == 0) {
+ virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP);
+ g_free(req);
+ return;
+ }
+
/*
* We require at least one output segment each for the virtio_blk_outhdr
* and the SCSI command block.

Ping.

Ping^2

Paolo




reply via email to

[Prev in Thread] Current Thread [Next in Thread]