[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 037/156] virtio-net: out-of-bounds buffer write on
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 037/156] virtio-net: out-of-bounds buffer write on load |
Date: |
Tue, 8 Jul 2014 12:17:08 -0500 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in
virtio_net_load()@hw/net/virtio-net.c
> } else if (n->mac_table.in_use) {
> uint8_t *buf = g_malloc0(n->mac_table.in_use);
We are allocating buffer of size n->mac_table.in_use
> qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN);
and read to the n->mac_table.in_use size buffer n->mac_table.in_use *
ETH_ALEN bytes, corrupting memory.
If adversary controls state then memory written there is controlled
by adversary.
Reviewed-by: Michael Roth <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit 98f93ddd84800f207889491e0b5d851386b459cf)
Signed-off-by: Michael Roth <address@hidden>
---
hw/net/virtio-net.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index e00d1c0..29c5f35 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1342,10 +1342,17 @@ static int virtio_net_load(QEMUFile *f, void *opaque,
int version_id)
if (n->mac_table.in_use <= MAC_TABLE_ENTRIES) {
qemu_get_buffer(f, n->mac_table.macs,
n->mac_table.in_use * ETH_ALEN);
- } else if (n->mac_table.in_use) {
- uint8_t *buf = g_malloc0(n->mac_table.in_use);
- qemu_get_buffer(f, buf, n->mac_table.in_use * ETH_ALEN);
- g_free(buf);
+ } else {
+ int64_t i;
+
+ /* Overflow detected - can happen if source has a larger MAC table.
+ * We simply set overflow flag so there's no need to maintain the
+ * table of addresses, discard them all.
+ * Note: 64 bit math to avoid integer overflow.
+ */
+ for (i = 0; i < (int64_t)n->mac_table.in_use * ETH_ALEN; ++i) {
+ qemu_get_byte(f);
+ }
n->mac_table.multi_overflow = n->mac_table.uni_overflow = 1;
n->mac_table.in_use = 0;
}
--
1.9.1
- [Qemu-stable] [PATCH 029/156] vmxnet3: validate queues configuration coming from guest, (continued)
- [Qemu-stable] [PATCH 029/156] vmxnet3: validate queues configuration coming from guest, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 027/156] acpi: fix tables for no-hpet configuration, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 006/156] target-i386: Fix ucomis and comis memory access, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 030/156] vmxnet3: validate interrupt indices read on migration, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 031/156] vmxnet3: validate queues configuration read on migration, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 028/156] vmxnet3: validate interrupt indices coming from guest, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 039/156] ahci: fix buffer overrun on invalid state load, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 033/156] vmstate: add VMS_MUST_EXIST, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 035/156] virtio-net: fix buffer overflow on invalid state load, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 032/156] vmstate: reduce code duplication, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 037/156] virtio-net: out-of-bounds buffer write on load,
Michael Roth <=
- [Qemu-stable] [PATCH 038/156] virtio: out-of-bounds buffer write on invalid state load, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 034/156] vmstate: add VMSTATE_VALIDATE, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 040/156] hpet: fix buffer overrun on invalid state load, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 048/156] pxa2xx: avoid buffer overrun on incoming migration, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 036/156] virtio-net: out-of-bounds buffer write on invalid state load, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 041/156] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 045/156] virtio: avoid buffer overrun on incoming migration, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 046/156] openpic: avoid buffer overrun on incoming migration, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 044/156] vmstate: fix buffer overflow in target-arm/machine.c, Michael Roth, 2014/07/08
- [Qemu-stable] [PATCH 043/156] Fix vmstate_info_int32_le comparison/assign, Michael Roth, 2014/07/08