[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer ov
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun |
Date: |
Fri, 11 Apr 2014 15:18:08 +0300 |
When VM guest programs multicast addresses for
a virtio net card, it supplies a 32 bit
entries counter for the number of addresses.
These addresses are read into tail portion of
a fixed macs array which has size MAC_TABLE_ENTRIES,
at offset equal to in_use.
To avoid overflow of this array by guest, qemu attempts
to test the size as follows:
- if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
however, as mac_data.entries is uint32_t, this sum
can overflow, e.g. if in_use is 1 and mac_data.entries
is 0xffffffff then in_use + mac_data.entries will be 0.
Qemu will then read guest supplied buffer into this
memory, overflowing buffer on heap.
CVE-2014-0150
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
Passed basic tests.
CVE fix so pick this up for -rc3?
hw/net/virtio-net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 439477b..33bd233 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -677,7 +677,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
goto error;
}
- if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
+ if (mac_data.entries <= MAC_TABLE_ENTRIES - in_use) {
s = iov_to_buf(iov, iov_cnt, 0, &macs[in_use * ETH_ALEN],
mac_data.entries * ETH_ALEN);
if (s != mac_data.entries * ETH_ALEN) {
--
MST
- [Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun,
Michael S. Tsirkin <=