[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 008/108] virtio-net: out-of-bounds buffer write on l
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 008/108] virtio-net: out-of-bounds buffer write on load |
Date: |
Wed, 6 Aug 2014 15:38:18 -0500 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in
virtio_net_load()@hw/net/virtio-net.c
> } else if (n->mac_table.in_use) {
> uint8_t *buf = g_malloc0(n->mac_table.in_use);
We are allocating buffer of size n->mac_table.in_use
> qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN);
and read to the n->mac_table.in_use size buffer n->mac_table.in_use *
ETH_ALEN bytes, corrupting memory.
If adversary controls state then memory written there is controlled
by adversary.
Reviewed-by: Michael Roth <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit 98f93ddd84800f207889491e0b5d851386b459cf)
Signed-off-by: Michael Roth <address@hidden>
---
hw/net/virtio-net.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 0a8cb40..940a7cf 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1362,10 +1362,17 @@ static int virtio_net_load(QEMUFile *f, void *opaque,
int version_id)
if (n->mac_table.in_use <= MAC_TABLE_ENTRIES) {
qemu_get_buffer(f, n->mac_table.macs,
n->mac_table.in_use * ETH_ALEN);
- } else if (n->mac_table.in_use) {
- uint8_t *buf = g_malloc0(n->mac_table.in_use);
- qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN);
- g_free(buf);
+ } else {
+ int64_t i;
+
+ /* Overflow detected - can happen if source has a larger MAC table.
+ * We simply set overflow flag so there's no need to maintain the
+ * table of addresses, discard them all.
+ * Note: 64 bit math to avoid integer overflow.
+ */
+ for (i = 0; i < (int64_t)n->mac_table.in_use * ETH_ALEN; ++i) {
+ qemu_get_byte(f);
+ }
n->mac_table.multi_overflow = n->mac_table.uni_overflow = 1;
n->mac_table.in_use = 0;
}
--
1.9.1
- [Qemu-devel] [000/108] Patch Round-up for stable 2.0.1, freeze on 2014-08-12, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 001/108] hw/net/stellaris_enet: Restructure tx_fifo code to avoid buffer overrun, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 003/108] vmstate: reduce code duplication, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 002/108] hw/net/stellaris_enet: Correct handling of packet padding, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 004/108] vmstate: add VMS_MUST_EXIST, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 008/108] virtio-net: out-of-bounds buffer write on load,
Michael Roth <=
- [Qemu-devel] [PATCH 005/108] vmstate: add VMSTATE_VALIDATE, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 009/108] ahci: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 006/108] virtio-net: fix buffer overflow on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 011/108] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 007/108] virtio-net: out-of-bounds buffer write on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 012/108] pl022: fix buffer overun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 010/108] hpet: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 013/108] vmstate: fix buffer overflow in target-arm/machine.c, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 015/108] virtio: validate num_sg when mapping, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 019/108] ssd0323: fix buffer overun on invalid state load, Michael Roth, 2014/08/06