[PULL for-9.2 0/1] 9p queue 2024-12-10

[PULL for-9.2 0/1] 9p queue 2024-12-10

[Christian Schoenebeck]

The following changes since commit 1cf9bc6eba7506ab6d9de635f224259225f63466:

  Update version for v9.2.0-rc3 release (2024-12-03 17:56:12 +0000)

are available in the Git repository at:

  https://github.com/cschoenebeck/qemu.git tags/pull-9p-20241210

for you to fetch changes up to d06a9d843fb65351e0e4dc42ba0c404f01ea92b3:

  9pfs: fix regression regarding CVE-2023-2861 (2024-12-10 10:24:52 +0100)

----------------------------------------------------------------
* Fix a regression regarding CVE-2023-2861 with security_model=passthrough
  which caused certain sockets on guest to fail.

----------------------------------------------------------------
Christian Schoenebeck (1):
      9pfs: fix regression regarding CVE-2023-2861

 hw/9pfs/9p-util.h | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

[PULL for-9.2 1/1] 9pfs: fix regression regarding CVE-2023-2861

[Christian Schoenebeck]

The released fix for this CVE:

  f6b0de53fb8 ("9pfs: prevent opening special files (CVE-2023-2861)")

caused a regression with security_model=passthrough. When handling a
'Tmknod' request there was a side effect that 'Tmknod' request could fail
as 9p server was trying to adjust permissions:

  #6  close_if_special_file (fd=30) at ../hw/9pfs/9p-util.h:140
  #7  openat_file (mode=<optimized out>, flags=2228224,
      name=<optimized out>, dirfd=<optimized out>) at
      ../hw/9pfs/9p-util.h:181
  #8  fchmodat_nofollow (dirfd=dirfd@entry=31,
      name=name@entry=0x5555577ea6e0 "mysocket", mode=493) at
      ../hw/9pfs/9p-local.c:360
  #9  local_set_cred_passthrough (credp=0x7ffbbc4ace10, name=0x5555577ea6e0
      "mysocket", dirfd=31, fs_ctx=0x55555811f528) at
      ../hw/9pfs/9p-local.c:457
  #10 local_mknod (fs_ctx=0x55555811f528, dir_path=<optimized out>,
      name=0x5555577ea6e0 "mysocket", credp=0x7ffbbc4ace10) at
      ../hw/9pfs/9p-local.c:702
  #11 v9fs_co_mknod (pdu=pdu@entry=0x555558121140,
      fidp=fidp@entry=0x5555574c46c0, name=name@entry=0x7ffbbc4aced0,
      uid=1000, gid=1000, dev=<optimized out>, mode=49645,
      stbuf=0x7ffbbc4acef0) at ../hw/9pfs/cofs.c:205
  #12 v9fs_mknod (opaque=0x555558121140) at ../hw/9pfs/9p.c:3711

That's because server was opening the special file to adjust permissions,
however it was using O_PATH and it would have not returned the file
descriptor to guest. So the call to close_if_special_file() on that branch
was incorrect.

Let's lift the restriction introduced by f6b0de53fb8 such that it would
allow to open special files on host if O_PATH flag is supplied, not only
for 9p server's own operations as described above, but also for any client
'Topen' request.

It is safe to allow opening special files with O_PATH on host, because
O_PATH only allows path based operations on the resulting file descriptor
and prevents I/O such as read() and write() on that file descriptor.

Fixes: f6b0de53fb8 ("9pfs: prevent opening special files (CVE-2023-2861)")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2337
Reported-by: Dirk Herrendorfer <d.herrendoerfer@de.ibm.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Tested-by: Dirk Herrendorfer <d.herrendoerfer@de.ibm.com>
Message-Id: <E1tJWbk-007BH4-OB@kylie.crudebyte.com>
---
 hw/9pfs/9p-util.h | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
index 51c94b0116..95ee4da9bd 100644
--- a/hw/9pfs/9p-util.h
+++ b/hw/9pfs/9p-util.h
@@ -177,20 +177,27 @@ again:
         return -1;
     }
 
-    if (close_if_special_file(fd) < 0) {
-        return -1;
-    }
-
-    serrno = errno;
-    /* O_NONBLOCK was only needed to open the file. Let's drop it. We don't
-     * do that with O_PATH since fcntl(F_SETFL) isn't supported, and openat()
-     * ignored it anyway.
-     */
+    /* Only if O_PATH is not set ... */
     if (!(flags & O_PATH_9P_UTIL)) {
+        /*
+         * Prevent I/O on special files (device files, etc.) on host side,
+         * however it is safe and required to allow opening them with O_PATH,
+         * as this is limited to (required) path based operations only.
+         */
+        if (close_if_special_file(fd) < 0) {
+            return -1;
+        }
+
+        serrno = errno;
+        /*
+         * O_NONBLOCK was only needed to open the file. Let's drop it. We don't
+         * do that with O_PATH since fcntl(F_SETFL) isn't supported, and
+         * openat() ignored it anyway.
+         */
         ret = fcntl(fd, F_SETFL, flags);
         assert(!ret);
+        errno = serrno;
     }
-    errno = serrno;
     return fd;
 }
 
-- 
2.30.2

Re: [PULL for-9.2 0/1] 9p queue 2024-12-10

[Peter Maydell]

On Tue, 10 Dec 2024 at 10:11, Christian Schoenebeck
<qemu_oss@crudebyte.com> wrote:
>
> The following changes since commit 1cf9bc6eba7506ab6d9de635f224259225f63466:
>
>   Update version for v9.2.0-rc3 release (2024-12-03 17:56:12 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/cschoenebeck/qemu.git tags/pull-9p-20241210
>
> for you to fetch changes up to d06a9d843fb65351e0e4dc42ba0c404f01ea92b3:
>
>   9pfs: fix regression regarding CVE-2023-2861 (2024-12-10 10:24:52 +0100)
>
> ----------------------------------------------------------------
> * Fix a regression regarding CVE-2023-2861 with security_model=passthrough
>   which caused certain sockets on guest to fail.
>
> ----------------------------------------------------------------

The commit message says it's a fix for a bug in commit f6b0de53fb,
which was in the 9.1 release. Is this really a regression since 9.1 ?

More generally, if you want to send a change on the day we're
due to make the final release, it needs to come with a clear
justification for why the bug is critical enough to force us
to delay the release by a week.

thanks
-- PMM

Re: [PULL for-9.2 0/1] 9p queue 2024-12-10

[Peter Maydell]

On Tue, 10 Dec 2024 at 10:11, Christian Schoenebeck
<qemu_oss@crudebyte.com> wrote:
>
> The following changes since commit 1cf9bc6eba7506ab6d9de635f224259225f63466:
>
>   Update version for v9.2.0-rc3 release (2024-12-03 17:56:12 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/cschoenebeck/qemu.git tags/pull-9p-20241210
>
> for you to fetch changes up to d06a9d843fb65351e0e4dc42ba0c404f01ea92b3:
>
>   9pfs: fix regression regarding CVE-2023-2861 (2024-12-10 10:24:52 +0100)
>
> ----------------------------------------------------------------
> * Fix a regression regarding CVE-2023-2861 with security_model=passthrough
>   which caused certain sockets on guest to fail.
>

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/10.0
for any user-visible changes.

-- PMM