[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 03/23] virtio-net: out-of-bounds buffer write on in
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-stable] [PATCH 03/23] virtio-net: out-of-bounds buffer write on invalid state load |
Date: |
Tue, 3 Dec 2013 18:28:30 +0200 |
CVE-2013-4150 QEMU 1.5.0 out-of-bounds buffer write in
virtio_net_load()@hw/net/virtio-net.c
This code is in hw/net/virtio-net.c:
if (n->max_queues > 1) {
if (n->max_queues != qemu_get_be16(f)) {
error_report("virtio-net: different max_queues ");
return -1;
}
n->curr_queues = qemu_get_be16(f);
for (i = 1; i < n->curr_queues; i++) {
n->vqs[i].tx_waiting = qemu_get_be32(f);
}
}
Number of vqs is max_queues, so if we get invalid input here,
for example if max_queues = 2, curr_queues = 3, we get
write beyond end of the buffer, with data that comes from
wire.
This might be used to corrupt qemu memory in hard to predict ways.
Since we have lots of function pointers around, RCE might be possible.
Signed-off-by: Michael S. Tsirkin <address@hidden>
Acked-by: Jason Wang <address@hidden>
Reviewed-by: Michael Roth <address@hidden>
---
hw/net/virtio-net.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 2b92640..383c1f5 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1383,6 +1383,11 @@ static int virtio_net_load(QEMUFile *f, void *opaque,
int version_id)
}
n->curr_queues = qemu_get_be16(f);
+ if (n->curr_queues > n->max_queues) {
+ error_report("virtio-net: curr_queues %x > max_queues %x",
+ n->curr_queues, n->max_queues);
+ return -1;
+ }
for (i = 1; i < n->curr_queues; i++) {
n->vqs[i].tx_waiting = qemu_get_be32(f);
}
--
MST
- [Qemu-stable] [PATCH 00/23] qemu state loading issues, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 01/23] virtio-net: fix buffer overflow on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 02/23] virtio-net: out-of-bounds buffer write on load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 03/23] virtio-net: out-of-bounds buffer write on invalid state load,
Michael S. Tsirkin <=
- [Qemu-stable] [PATCH 05/23] ahci: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 06/23] hpet: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 07/23] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Michael S. Tsirkin, 2013/12/03