Re: [PATCH 0/6] io/channel-websock: fix an unauthenticated crash in the handshake

["Denis V. Lunev" <den@virtuozzo.com>]

On 8/31/26 13:29, marcandre.lureau@redhat.com wrote:
>> A client which can reach a VNC websocket port crashes QEMU before it has
>> authenticated, by sending an HTTP greeting whose request line holds no
>> space:
>>
>>   printf 'stats\r\nx\r\n\r\n' | nc $host $port
>>
>> Three defects line up to produce it. The greeting is rejected without
>> queueing a response, so the handshake goes on to flush an empty buffer.
>> A zero length sendmsg() succeeds and returns 0, which
>> qio_channel_socket_writev() mistakes for failure and reports as
>> QIO_CHANNEL_ERR_BLOCK with errp left unset. The handshake treats every
>> negative return as fatal and hands that NULL Error to
>> error_get_pretty(). Patches 1 to 3 close the three links.
>>
>> Patch 5 is the same NULL Error on the read side of the handshake, where
>> ERR_BLOCK is folded into -1. It is reachable for a wss:// client, whose
>> master channel is then a TLS channel: a wakeup carrying only part of a
>> record makes gnutls report EAGAIN.
>>
>> The tests drive the handshake through a channel which reports ERR_BLOCK
>> on demand, covering both directions. No test reproduces the original
>> crash itself, which turns on a stale errno and is not reliably
>> reproducible in a unit test. What they pin is that a 400 is emitted and
>> that ERR_BLOCK no longer reaches error_get_pretty().
>>
>> Signed-off-by: Denis V. Lunev <den@openvz.org>
>> CC: Daniel P. Berrangé <berrange@redhat.com>
>> CC: Marc-André Lureau <marcandre.lureau@redhat.com>
>>
>> Denis V. Lunev (6):
>>   io/channel-socket: do not treat a zero length write as an error
>>   io/channel-websock: send an HTTP 400 when the greeting has no space
>>   io/channel-websock: handle a blocked write during the handshake
>>   tests/unit: add websock handshake test
>>   io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
>>   tests/unit: cover blocked IO during the websock handshake
>>
>>  io/channel-socket.c                  |   2 +-
>>  io/channel-websock.c                 |  10 +-
>>  tests/unit/meson.build               |   1 +
>>  tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++
>>  4 files changed, 260 insertions(+), 2 deletions(-)
>>  create mode 100644 tests/unit/test-io-channel-websock.c
>>
> Patch series lgtm. You cc stable, why didn't you file a CVE?
>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
>
I have calculated the scope and get around 6.2 which is
not looking too impressive to spend a time.

There are toooooo many CVEs circulating around :-)

If this is wrong approach - let me know. I'll change
the approach.

Thanks for review,
    Den