qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH v4 16/30] virtio: avoid buffer overrun on incomi


From: Peter Maydell
Subject: Re: [Qemu-devel] [PATCH v4 16/30] virtio: avoid buffer overrun on incoming migration
Date: Mon, 31 Mar 2014 17:09:04 +0100

On 31 March 2014 15:16, Michael S. Tsirkin <address@hidden> wrote:
> From: Michael Roth <address@hidden>
>
> CVE-2013-6399
>
> vdev->queue_sel is read from the wire, and later used in the
> emulation code as an index into vdev->vq[]. If the value of
> vdev->queue_sel exceeds the length of vdev->vq[], currently
> allocated to be VIRTIO_PCI_QUEUE_MAX elements, subsequent PIO
> operations such as VIRTIO_PCI_QUEUE_PFN can be used to overrun
> the buffer with arbitrary data originating from the source.
>
> Fix this by failing migration if the value from the wire exceeds
> VIRTIO_PCI_QUEUE_MAX.
>
> Signed-off-by: Michael Roth <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> ---
>  hw/virtio/virtio.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index 9008430..bcbfbb2 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -907,6 +907,9 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
>      qemu_get_8s(f, &vdev->status);
>      qemu_get_8s(f, &vdev->isr);
>      qemu_get_be16s(f, &vdev->queue_sel);
> +    if (vdev->queue_sel >= VIRTIO_PCI_QUEUE_MAX) {
> +        return -1;
> +    }
>      qemu_get_be32s(f, &features);
>
>      if (virtio_set_features(vdev, features) < 0) {

Reviewed-by: Peter Maydell <address@hidden>

We should probably rename VIRTIO_PCI_QUEUE_MAX at some
point -- it's not PCI transport specific.

thanks
-- PMM



reply via email to

[Prev in Thread] Current Thread [Next in Thread]