From: Juan Quintela <quintela@redhat.com>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>,
qemu-devel@nongnu.org, mdroth@linux.vnet.ibm.com,
qemu-stable@nongnu.org, Alexey Kardashevskiy <aik@ozlabs.ru>,
Anthony Liguori <anthony@codemonkey.ws>,
Amit Shah <amit.shah@redhat.com>,
dgilbert@redhat.com
Subject: Re: [Qemu-devel] [PATCH v5 12/24] vmstate: fix buffer overflow in target-arm/machine.c
Date: Fri, 04 Apr 2014 11:43:16 +0200 [thread overview]
Message-ID: <87ppkx8m6j.fsf@elfo.mitica> (raw)
In-Reply-To: <1396543778-22307-13-git-send-email-mst@redhat.com> (Michael S. Tsirkin's message of "Thu, 3 Apr 2014 19:51:42 +0300")
"Michael S. Tsirkin" <mst@redhat.com> wrote:
> CVE-2013-4531
>
> cpreg_vmstate_indexes is a VARRAY_INT32. A negative value for
> cpreg_vmstate_array_len will cause a buffer overflow.
>
> VMSTATE_INT32_LE was supposed to protect against this
> but doesn't because it doesn't validate that input is
> non-negative.
>
> Fix this macro to valide the value appropriately.
>
> The only other user of VMSTATE_INT32_LE doesn't
> ever use negative numbers so it doesn't care.
>
> Reported-by: Anthony Liguori <anthony@codemonkey.ws>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Integrated.
next prev parent reply other threads:[~2014-04-04 9:43 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-03 16:50 [Qemu-devel] [PATCH v5 00/24] qemu state loading issues Michael S. Tsirkin
2014-04-03 16:50 ` [Qemu-devel] [PATCH v5 01/24] vmstate: reduce code duplication Michael S. Tsirkin
2014-04-04 9:37 ` Juan Quintela
2014-04-03 16:50 ` [Qemu-devel] [PATCH v5 03/24] vmstate: add VMSTATE_VALIDATE Michael S. Tsirkin
2014-04-03 16:50 ` [Qemu-devel] [PATCH v5 04/24] virtio-net: fix buffer overflow on invalid state load Michael S. Tsirkin
2014-04-03 16:50 ` [Qemu-devel] [PATCH v5 05/24] virtio-net: out-of-bounds buffer write on load Michael S. Tsirkin
2014-04-03 17:26 ` Peter Maydell
2014-04-03 16:50 ` [Qemu-devel] [PATCH v5 06/24] virtio-net: out-of-bounds buffer write on invalid state load Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 07/24] virtio: " Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 08/24] ahci: fix buffer overrun " Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 09/24] hpet: " Michael S. Tsirkin
2014-04-04 9:51 ` Juan Quintela
2014-04-04 14:47 ` Michael S. Tsirkin
2014-04-04 15:04 ` Michael S. Tsirkin
2014-04-04 15:11 ` Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 10/24] hw/pci/pcie_aer.c: fix buffer overruns " Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 11/24] pl022: fix buffer overun " Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 12/24] vmstate: fix buffer overflow in target-arm/machine.c Michael S. Tsirkin
2014-04-04 9:43 ` Juan Quintela [this message]
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 13/24] virtio: avoid buffer overrun on incoming migration Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 14/24] openpic: " Michael S. Tsirkin
2014-04-03 18:04 ` Alexander Graf
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 15/24] virtio: validate num_sg when mapping Michael S. Tsirkin
2014-04-03 16:51 ` [Qemu-devel] [PATCH v5 16/24] pxa2xx: avoid buffer overrun on incoming migration Michael S. Tsirkin
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 17/24] ssi-sd: fix buffer overrun on invalid state load Michael S. Tsirkin
2014-04-03 17:05 ` Peter Maydell
2014-04-03 17:51 ` Michael S. Tsirkin
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 18/24] ssd0323: fix buffer overun " Michael S. Tsirkin
2014-04-03 17:13 ` Peter Maydell
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 19/24] tsc210x: fix buffer overrun " Michael S. Tsirkin
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 20/24] zaurus: " Michael S. Tsirkin
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 21/24] virtio-scsi: " Michael S. Tsirkin
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 22/24] vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ Michael S. Tsirkin
2014-04-04 9:43 ` Juan Quintela
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 23/24] usb: sanity check setup_index+setup_len in post_load Michael S. Tsirkin
2014-04-07 7:14 ` Gerd Hoffmann
2014-04-03 16:52 ` [Qemu-devel] [PATCH v5 24/24] savevm: Ignore minimum_version_id_old if there is no load_state_old Michael S. Tsirkin
2014-04-04 9:45 ` Juan Quintela
[not found] ` <1396543778-22307-3-git-send-email-mst@redhat.com>
2014-04-04 9:41 ` [Qemu-devel] [PATCH v5 02/24] vmstate: add VMS_MUST_EXIST Juan Quintela
2014-04-04 9:54 ` Dr. David Alan Gilbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ppkx8m6j.fsf@elfo.mitica \
--to=quintela@redhat.com \
--cc=aik@ozlabs.ru \
--cc=amit.shah@redhat.com \
--cc=anthony@codemonkey.ws \
--cc=dgilbert@redhat.com \
--cc=mdroth@linux.vnet.ibm.com \
--cc=mst@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.