[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 12/23] stellaris_enet: avoid buffer orerrun on i
From: |
Peter Maydell |
Subject: |
Re: [Qemu-devel] [PATCH 12/23] stellaris_enet: avoid buffer orerrun on incoming migration (part 3) |
Date: |
Tue, 3 Dec 2013 20:22:05 +0000 |
On 3 December 2013 16:28, Michael S. Tsirkin <address@hidden> wrote:
> From: Michael Roth <address@hidden>
>
> CVE-2013-4532
>
> s->tx_frame_len is read from the wire and can later used as an index
> into s->tx_fifo[] for memset() when a DATA command is issued by the guest.
>
> In this case s->tx_frame_len is checked to avoid an overrun, but if the
> value is negative a subsequently executed guest can underrun the buffer
> with zeros via the memset() call.
>
> Fix this by failing migration if the incoming value is of s->tx_frame_len
> is less than -1 (the emulation code allows from -1 as a special case)
>
> Signed-off-by: Michael Roth <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> ---
> hw/net/stellaris_enet.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c
> index 65f0ba8..6eca31e 100644
> --- a/hw/net/stellaris_enet.c
> +++ b/hw/net/stellaris_enet.c
> @@ -375,6 +375,9 @@ static int stellaris_enet_load(QEMUFile *f, void *opaque,
> int version_id)
> s->mrxd = qemu_get_be32(f);
> s->np = qemu_get_be32(f);
> s->tx_frame_len = qemu_get_be32(f);
> + if (s->tx_frame_len < -1) {
> + return -EINVAL;
> + }
Don't we need to also check that tx_frame_len <= 2032?
Otherwise the migration stream could set it to some large
positive number and use this to bypass the check on whether
writing to tx_fifo[tx_fifo_len] has hit the end of the fifo buffer,
I think.
> s->tx_fifo_len = qemu_get_be32(f);
> if (s->tx_fifo_len < 0 || s->tx_fifo_len > SE_FIFO_LEN) {
> return -EINVAL;
> --
> MST
>
thanks
-- PMM
[Qemu-devel] [PATCH 08/23] pl022: fix buffer overun on invalid state load, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 09/23] target-arm/machine.c: fix buffer overflow on invalid state load, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 10/23] stellaris_enet: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 12/23] stellaris_enet: avoid buffer orerrun on incoming migration (part 3), Michael S. Tsirkin, 2013/12/03
- Re: [Qemu-devel] [PATCH 12/23] stellaris_enet: avoid buffer orerrun on incoming migration (part 3),
Peter Maydell <=
[Qemu-devel] [PATCH 13/23] virtio: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 14/23] openpic: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 15/23] pxa2xx: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 16/23] virtio: validate num_sg when mapping, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 17/23] ssi-sd: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
[Qemu-devel] [PATCH 18/23] ssd0323: fix buffer overun on invalid state load, Michael S. Tsirkin, 2013/12/03