[Bug 1913873] Re: QEMU: net: vmxnet: integer overflow may crash guest

[P J P]

** Information type changed from Private Security to Public Security

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1913873

Title:
  QEMU: net: vmxnet: integer overflow may crash guest

Status in QEMU:
  New

Bug description:
  * Gaoning Pan from Zhejiang University & Ant Security Light-Year Lab reported 
a malloc failure
    issue locates in vmxnet3_activate_device() of qemu/hw/net/vmxnet3.c NIC 
emulator

  * This issue is reproducible  because while activating the NIC device, 
vmxnet3_activate_device
    does not validate guest supplied configuration values against predefined 
min/max limits.

  @@ -1420,6 +1420,7 @@ static void vmxnet3_activate_device(VMXNET3State *s)
       vmxnet3_setup_rx_filtering(s);
       /* Cache fields from shared memory */
       s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
  +    assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);    <= Did 
not check if MTU is within range
       VMW_CFPRN("MTU is %u", s->mtu);
   
       s->max_rx_frags =
  @@ -1473,6 +1474,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
           /* Read rings memory locations for TX queues */
           pa = VMXNET3_READ_TX_QUEUE_DESCR64(d, qdescr_pa, conf.txRingBasePA);
           size = VMXNET3_READ_TX_QUEUE_DESCR32(d, qdescr_pa, conf.txRingSize);
  +        if (size > VMXNET3_TX_RING_MAX_SIZE) {                      <= Did 
not check TX ring size
  +            size = VMXNET3_TX_RING_MAX_SIZE;
  +        }
   
           vmxnet3_ring_init(d, &s->txq_descr[i].tx_ring, pa, size,
                             sizeof(struct Vmxnet3_TxDesc), false);
  @@ -1483,6 +1487,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
           /* TXC ring */
           pa = VMXNET3_READ_TX_QUEUE_DESCR64(d, qdescr_pa, 
conf.compRingBasePA);
           size = VMXNET3_READ_TX_QUEUE_DESCR32(d, qdescr_pa, 
conf.compRingSize);
  +        if (size > VMXNET3_TC_RING_MAX_SIZE) {                       <= Did 
not check TC ring size 
  +            size = VMXNET3_TC_RING_MAX_SIZE;
  +        }
           vmxnet3_ring_init(d, &s->txq_descr[i].comp_ring, pa, size,
                             sizeof(struct Vmxnet3_TxCompDesc), true);
           VMXNET3_RING_DUMP(VMW_CFPRN, "TXC", i, &s->txq_descr[i].comp_ring);
  @@ -1524,6 +1531,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
               /* RX rings */
               pa = VMXNET3_READ_RX_QUEUE_DESCR64(d, qd_pa, 
conf.rxRingBasePA[j]);
               size = VMXNET3_READ_RX_QUEUE_DESCR32(d, qd_pa, 
conf.rxRingSize[j]);
  +            if (size > VMXNET3_RX_RING_MAX_SIZE) {                   <= Did 
not check RX ring size
  +                size = VMXNET3_RX_RING_MAX_SIZE;
  +            }
               vmxnet3_ring_init(d, &s->rxq_descr[i].rx_ring[j], pa, size,
                                 sizeof(struct Vmxnet3_RxDesc), false);
               VMW_CFPRN("RX queue %d:%d: Base: %" PRIx64 ", Size: %d",
  @@ -1533,6 +1543,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
           /* RXC ring */
           pa = VMXNET3_READ_RX_QUEUE_DESCR64(d, qd_pa, conf.compRingBasePA);
           size = VMXNET3_READ_RX_QUEUE_DESCR32(d, qd_pa, conf.compRingSize);
  +        if (size > VMXNET3_RC_RING_MAX_SIZE) {                      <= Did 
not check RC ring size
  +            size = VMXNET3_RC_RING_MAX_SIZE;
  +        }

  This may lead to potential integer overflow OR OOB buffer access
  issues.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1913873/+subscriptions