[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-8.1.2 23/45] hw/scsi/scsi-disk: Disallow block sizes smaller tha
From: |
Michael Tokarev |
Subject: |
[Stable-8.1.2 23/45] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] |
Date: |
Wed, 4 Oct 2023 11:01:44 +0300 |
From: Thomas Huth <thuth@redhat.com>
We are doing things like
nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7cfcc79b0ab800959716738aff9419f53fc68c9c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index e0d79c7966..477ee2bcd4 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq
*r, uint8_t *inbuf)
* Since the existing code only checks/updates bits 8-15 of the block
* size, restrict ourselves to the same requirement for now to ensure
* that a block size set by a block descriptor and then read back by
- * a subsequent SCSI command will be the same
+ * a subsequent SCSI command will be the same. Also disallow a block
+ * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE.
*/
- if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) {
+ if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) {
s->qdev.blocksize = bs;
trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize);
}
--
2.39.2
- [Stable-8.1.2 14/45] file-posix: Check bs->bl.zoned for zone info, (continued)
- [Stable-8.1.2 14/45] file-posix: Check bs->bl.zoned for zone info, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 12/45] hw/cxl: Fix out of bound array access, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 09/45] linux-user/hppa: clear the PSW 'N' bit when delivering signals, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 05/45] target/ppc: Sign-extend large decrementer to 64-bits, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 06/45] hw/ppc: Always store the decrementer value, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 24/45] ui/vnc: fix debug output for invalid audio message, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 27/45] migration: Fix possible race when setting rp_state.error, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 19/45] hw/arm/boot: Set SCR_EL3.FGTEn when booting kernel, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 20/45] target/arm: Don't skip MTE checks for LDRT/STRT at EL0, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 21/45] meson.build: Make keyutils independent from keyring, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 23/45] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467],
Michael Tokarev <=
- [Stable-8.1.2 18/45] include/exec: Widen tlb_hit/tlb_hit_page(), Michael Tokarev, 2023/10/04
- [Stable-8.1.2 25/45] ui/vnc: fix handling of VNC_FEATURE_XVP, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 26/45] migration: Fix race that dest preempt thread close too early, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 17/45] tests/file-io-error: New test, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 22/45] accel/tcg: mttcg remove false-negative halted assertion, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 29/45] migration: Fix possible race when shutting down to_dst_file, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 30/45] migration: Remove redundant cleanup of postcopy_qemufile_src, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 28/45] migration: Fix possible races when shutting down the return path, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 31/45] migration: Consolidate return path closing code, Michael Tokarev, 2023/10/04
- [Stable-8.1.2 33/45] migration: Move return path cleanup to main migration thread, Michael Tokarev, 2023/10/04