[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 05/36] virtio-net: out-of-bounds buffer write on inv
From: |
Juan Quintela |
Subject: |
[Qemu-devel] [PATCH 05/36] virtio-net: out-of-bounds buffer write on invalid state load |
Date: |
Mon, 5 May 2014 22:30:03 +0200 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4150 QEMU 1.5.0 out-of-bounds buffer write in
virtio_net_load()@hw/net/virtio-net.c
This code is in hw/net/virtio-net.c:
if (n->max_queues > 1) {
if (n->max_queues != qemu_get_be16(f)) {
error_report("virtio-net: different max_queues ");
return -1;
}
n->curr_queues = qemu_get_be16(f);
for (i = 1; i < n->curr_queues; i++) {
n->vqs[i].tx_waiting = qemu_get_be32(f);
}
}
Number of vqs is max_queues, so if we get invalid input here,
for example if max_queues = 2, curr_queues = 3, we get
write beyond end of the buffer, with data that comes from
wire.
This might be used to corrupt qemu memory in hard to predict ways.
Since we have lots of function pointers around, RCE might be possible.
Signed-off-by: Michael S. Tsirkin <address@hidden>
Acked-by: Jason Wang <address@hidden>
Reviewed-by: Michael Roth <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
---
hw/net/virtio-net.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 33bd233..0a8cb40 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1407,6 +1407,11 @@ static int virtio_net_load(QEMUFile *f, void *opaque,
int version_id)
}
n->curr_queues = qemu_get_be16(f);
+ if (n->curr_queues > n->max_queues) {
+ error_report("virtio-net: curr_queues %x > max_queues %x",
+ n->curr_queues, n->max_queues);
+ return -1;
+ }
for (i = 1; i < n->curr_queues; i++) {
n->vqs[i].tx_waiting = qemu_get_be32(f);
}
--
1.9.0
- [Qemu-devel] [PULL 00/36] migration queue, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 05/36] virtio-net: out-of-bounds buffer write on invalid state load,
Juan Quintela <=
- [Qemu-devel] [PATCH 07/36] ahci: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 04/36] virtio-net: fix buffer overflow on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 03/36] vmstate: add VMSTATE_VALIDATE, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 01/36] vmstate: reduce code duplication, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 06/36] virtio: out-of-bounds buffer write on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 08/36] hpet: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 09/36] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 10/36] pl022: fix buffer overun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 11/36] vmstate: fix buffer overflow in target-arm/machine.c, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 12/36] virtio: avoid buffer overrun on incoming migration, Juan Quintela, 2014/05/05