From mboxrd@z Thu Jan  1 00:00:00 1970
From: Mark McLoughlin <markmc@redhat.com>
Subject: Re: [PATCH] whitelist host virtio networking features [was Re:
 qemu-kvm-0.11 regression, crashes on older ...]
Date: Mon, 02 Nov 2009 09:38:42 -0500
Message-ID: <1257172722.5075.7.camel@blaa>
References: <d9c105ea0910281222u76a61a2by3cc924e85d40a865@mail.gmail.com>
	 <1256807803.10825.39.camel@blaa> <1256815818-sup-7805@xpc65.scottt>
	 <1256818566.10825.58.camel@blaa> <4AE9A299.5060003@codemonkey.ws>
	 <1256826351.10825.69.camel@blaa> <4AE9A90F.1060108@codemonkey.ws>
	 <1256827719.10825.75.camel@blaa> <1256830455.25064.155.camel@x200>
	 <d9c105ea0910301415n74efc9f2i3f8b2646217f44cb@mail.gmail.com>
Reply-To: Mark McLoughlin <markmc@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Cc: Anthony Liguori <anthony@codemonkey.ws>,
	Scott Tsai <scottt.tw@gmail.com>,
	qemu-devel <qemu-devel@nongnu.org>, kvm <kvm@vger.kernel.org>,
	Rusty Russell <rusty@rustcorp.com.au>, jdstrand@canonical.com,
	kees.cook@canonical.com,
	Marc Deslauriers <marc.deslauriers@canonical.com>
To: Dustin Kirkland <kirkland@canonical.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx1.redhat.com ([209.132.183.28]:3231 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1755243AbZKBOlB (ORCPT <rfc822;kvm@vger.kernel.org>);
	Mon, 2 Nov 2009 09:41:01 -0500
In-Reply-To: <d9c105ea0910301415n74efc9f2i3f8b2646217f44cb@mail.gmail.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On Fri, 2009-10-30 at 16:15 -0500, Dustin Kirkland wrote:
> On Thu, Oct 29, 2009 at 10:34 AM, Dustin Kirkland
> <kirkland@canonical.com> wrote:
> > whitelist host virtio networking features
> >
> > This patch is a followup to 8eca6b1bc770982595db2f7207c65051572436cb,
> > fixing crashes when guests with 2.6.25 virtio drivers have saturated
> > virtio network connections.
> >
> > https://bugs.edge.launchpad.net/ubuntu/+source/qemu-kvm/+bug/458521
> >
> > That patch should have been whitelisting *_HOST_* rather than the the
> > *_GUEST_* features.
> >
> > I tested this by running an Ubuntu 8.04 Hardy guest (2.6.24 kernel +
> > 2.6.25-virtio driver).  I saturated both the incoming, and outgoing
> > network connection with nc, seeing sustained 6MB/s up and 6MB/s down
> > bitrates for ~20 minutes.  Previously, this crashed immediately.  Now,
> > the guest does not crash and maintains network connectivity throughout
> > the test.
> <snip>
> 
> FYI...

Thanks for the notice

> Canonical's Ubuntu Security Team will be filing a CVE on this issue,
> since there is a bit of an attack vector here, and since
> qemu-kvm-0.11.0 is generally available as an official release (and now
> part of Ubuntu 9.10).
> 
> Guests running linux <= 2.6.25 virtio-net (e.g Ubuntu 8.04 hardy) on
> top of qemu-kvm-0.11.0 can be remotely crashed by a non-privileged
> network user flooding an open port on the guest.  The crash happens in
> a manner that abruptly terminates the guest's execution (ie, without
> shutting down cleanly).  This may affect the guest filesystem's
> general happiness.

IMHO, the CVE should be against the 2.6.25 virtio drivers - the bug is
in the guest and the issue we're discussing here is just a hacky
workaround for the guest bug.

Cheers,
Mark.