* [PATCH 1/6] qemu: Security fix CVE-2015-8504
2016-01-29 20:35 [PATCH 0/6][Jethro] Jethro-next qemu security fixes Armin Kuster
@ 2016-01-29 20:35 ` Armin Kuster
2016-01-29 20:35 ` [PATCH 2/6] qemu: Security fix CVE-2015-7504 Armin Kuster
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Armin Kuster @ 2016-01-29 20:35 UTC (permalink / raw)
To: openembedded-core, liezhi.yang
From: Armin Kuster <akuster@mvista.com>
CVE-2015-8504 Qemu: ui: vnc: avoid floating point exception
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
.../recipes-devtools/qemu/qemu/CVE-2015-8504.patch | 51 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 52 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-8504.patch
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-8504.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-8504.patch
new file mode 100644
index 0000000..9e66021
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-8504.patch
@@ -0,0 +1,51 @@
+From 4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Thu, 3 Dec 2015 18:54:17 +0530
+Subject: [PATCH] ui: vnc: avoid floating point exception
+
+While sending 'SetPixelFormat' messages to a VNC server,
+the client could set the 'red-max', 'green-max' and 'blue-max'
+values to be zero. This leads to a floating point exception in
+write_png_palette while doing frame buffer updates.
+
+Reported-by: Lian Yihan <lianyihan@360.cn>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+
+Upstream-Status: Backport
+
+http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8
+
+CVE: CVE-2015-8504
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ ui/vnc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Index: qemu-2.4.0/ui/vnc.c
+===================================================================
+--- qemu-2.4.0.orig/ui/vnc.c
++++ qemu-2.4.0/ui/vnc.c
+@@ -2189,15 +2189,15 @@ static void set_pixel_format(VncState *v
+ return;
+ }
+
+- vs->client_pf.rmax = red_max;
++ vs->client_pf.rmax = red_max ? red_max : 0xFF;
+ vs->client_pf.rbits = hweight_long(red_max);
+ vs->client_pf.rshift = red_shift;
+ vs->client_pf.rmask = red_max << red_shift;
+- vs->client_pf.gmax = green_max;
++ vs->client_pf.gmax = green_max ? green_max : 0xFF;
+ vs->client_pf.gbits = hweight_long(green_max);
+ vs->client_pf.gshift = green_shift;
+ vs->client_pf.gmask = green_max << green_shift;
+- vs->client_pf.bmax = blue_max;
++ vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
+ vs->client_pf.bbits = hweight_long(blue_max);
+ vs->client_pf.bshift = blue_shift;
+ vs->client_pf.bmask = blue_max << blue_shift;
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 1505b80..fec1061 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -10,6 +10,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://smc91c111_fix2.patch \
file://smc91c111_fix3.patch \
file://no-valgrind.patch \
+ file://CVE-2015-8504.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
2.3.5
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 2/6] qemu: Security fix CVE-2015-7504
2016-01-29 20:35 [PATCH 0/6][Jethro] Jethro-next qemu security fixes Armin Kuster
2016-01-29 20:35 ` [PATCH 1/6] qemu: Security fix CVE-2015-8504 Armin Kuster
@ 2016-01-29 20:35 ` Armin Kuster
2016-01-29 20:35 ` [PATCH 3/6] qemu: Security fix CVE-2015-7512 Armin Kuster
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Armin Kuster @ 2016-01-29 20:35 UTC (permalink / raw)
To: openembedded-core, liezhi.yang
From: Armin Kuster <akuster@mvista.com>
CVE-2015-7504 Qemu: net: pcnet: heap overflow vulnerability in loopback mode
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
.../recipes-devtools/qemu/qemu/CVE-2015-7504.patch | 56 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 57 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7504.patch
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7504.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7504.patch
new file mode 100644
index 0000000..90a7947
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7504.patch
@@ -0,0 +1,56 @@
+From 837f21aacf5a714c23ddaadbbc5212f9b661e3f7 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Fri, 20 Nov 2015 11:50:31 +0530
+Subject: [PATCH] net: pcnet: add check to validate receive data
+ size(CVE-2015-7504)
+
+In loopback mode, pcnet_receive routine appends CRC code to the
+receive buffer. If the data size given is same as the buffer size,
+the appended CRC code overwrites 4 bytes after s->buffer. Added a
+check to avoid that.
+
+Reported by: Qinghao Tang <luodalongde@gmail.com>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+
+Upstream-Status: Backport
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7
+
+CVE: CVE-2015-7504
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/net/pcnet.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+Index: qemu-2.4.0/hw/net/pcnet.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/pcnet.c
++++ qemu-2.4.0/hw/net/pcnet.c
+@@ -1085,7 +1085,7 @@ ssize_t pcnet_receive(NetClientState *nc
+ uint32_t fcs = ~0;
+ uint8_t *p = src;
+
+- while (p != &src[size-4])
++ while (p != &src[size])
+ CRC(fcs, *p++);
+ crc_err = (*(uint32_t *)p != htonl(fcs));
+ }
+@@ -1234,8 +1234,10 @@ static void pcnet_transmit(PCNetState *s
+ bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
+
+ /* if multi-tmd packet outsizes s->buffer then skip it silently.
+- Note: this is not what real hw does */
+- if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
++ * Note: this is not what real hw does.
++ * Last four bytes of s->buffer are used to store CRC FCS code.
++ */
++ if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
+ s->xmit_pos = -1;
+ goto txdone;
+ }
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index fec1061..58ce3b5 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -11,6 +11,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://smc91c111_fix3.patch \
file://no-valgrind.patch \
file://CVE-2015-8504.patch \
+ file://CVE-2015-7504.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
2.3.5
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 3/6] qemu: Security fix CVE-2015-7512
2016-01-29 20:35 [PATCH 0/6][Jethro] Jethro-next qemu security fixes Armin Kuster
2016-01-29 20:35 ` [PATCH 1/6] qemu: Security fix CVE-2015-8504 Armin Kuster
2016-01-29 20:35 ` [PATCH 2/6] qemu: Security fix CVE-2015-7504 Armin Kuster
@ 2016-01-29 20:35 ` Armin Kuster
2016-01-29 20:35 ` [PATCH 4/6] qemu: Security fix CVE-2015-8345 Armin Kuster
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Armin Kuster @ 2016-01-29 20:35 UTC (permalink / raw)
To: openembedded-core, liezhi.yang
From: Armin Kuster <akuster@mvista.com>
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mod
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
.../recipes-devtools/qemu/qemu/CVE-2015-7512.patch | 44 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch
new file mode 100644
index 0000000..50b8a6c
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7512.patch
@@ -0,0 +1,44 @@
+From 8b98a2f07175d46c3f7217639bd5e03f2ec56343 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Mon, 30 Nov 2015 15:00:06 +0800
+Subject: [PATCH] pcnet: fix rx buffer overflow(CVE-2015-7512)
+
+Backends could provide a packet whose length is greater than buffer
+size. Check for this and truncate the packet to avoid rx buffer
+overflow in this case.
+
+Cc: Prasad J Pandit <pjp@fedoraproject.org>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+
+Upsteam_Status: Backport
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343
+
+CVE: CVE-2015-7512
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/net/pcnet.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+Index: qemu-2.4.0/hw/net/pcnet.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/pcnet.c
++++ qemu-2.4.0/hw/net/pcnet.c
+@@ -1065,6 +1065,12 @@ ssize_t pcnet_receive(NetClientState *nc
+ int pktcount = 0;
+
+ if (!s->looptest) {
++ if (size > 4092) {
++#ifdef PCNET_DEBUG_RMD
++ fprintf(stderr, "pcnet: truncates rx packet.\n");
++#endif
++ size = 4092;
++ }
+ memcpy(src, buf, size);
+ /* no need to compute the CRC */
+ src[size] = 0;
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 58ce3b5..b5c717c 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -12,6 +12,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://no-valgrind.patch \
file://CVE-2015-8504.patch \
file://CVE-2015-7504.patch \
+ file://CVE-2015-7512.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
2.3.5
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 4/6] qemu: Security fix CVE-2015-8345
2016-01-29 20:35 [PATCH 0/6][Jethro] Jethro-next qemu security fixes Armin Kuster
` (2 preceding siblings ...)
2016-01-29 20:35 ` [PATCH 3/6] qemu: Security fix CVE-2015-7512 Armin Kuster
@ 2016-01-29 20:35 ` Armin Kuster
2016-01-29 20:35 ` [PATCH 5/6] qemu: Security fix CVE-2016-1568 Armin Kuster
2016-01-29 20:35 ` [PATCH 6/6] qemu: Security fix CVE-2015-7295 Armin Kuster
5 siblings, 0 replies; 7+ messages in thread
From: Armin Kuster @ 2016-01-29 20:35 UTC (permalink / raw)
To: openembedded-core, liezhi.yang
From: Armin Kuster <akuster@mvista.com>
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
.../recipes-devtools/qemu/qemu/CVE-2015-8345.patch | 73 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 74 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch
new file mode 100644
index 0000000..310b458
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-8345.patch
@@ -0,0 +1,73 @@
+From 00837731d254908a841d69298a4f9f077babaf24 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 20 Nov 2015 08:42:33 +0100
+Subject: [PATCH] eepro100: Prevent two endless loops
+
+http://lists.nongnu.org/archive/html/qemu-devel/2015-11/msg04592.html
+shows an example how an endless loop in function action_command can
+be achieved.
+
+During my code review, I noticed a 2nd case which can result in an
+endless loop.
+
+Reported-by: Qinghao Tang <luodalongde@gmail.com>
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+
+Upstream-Status: Backport
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24
+
+CVE: CVE-2015-8345
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/net/eepro100.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
+index 60333b7..685a478 100644
+--- a/hw/net/eepro100.c
++++ b/hw/net/eepro100.c
+@@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s)
+ #if 0
+ uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6);
+ #endif
++ if (tx_buffer_size == 0) {
++ /* Prevent an endless loop. */
++ logout("loop in %s:%u\n", __FILE__, __LINE__);
++ break;
++ }
+ tbd_address += 8;
+ TRACE(RXTX, logout
+ ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
+@@ -855,6 +860,10 @@ static void set_multicast_list(EEPRO100State *s)
+
+ static void action_command(EEPRO100State *s)
+ {
++ /* The loop below won't stop if it gets special handcrafted data.
++ Therefore we limit the number of iterations. */
++ unsigned max_loop_count = 16;
++
+ for (;;) {
+ bool bit_el;
+ bool bit_s;
+@@ -870,6 +879,13 @@ static void action_command(EEPRO100State *s)
+ #if 0
+ bool bit_sf = ((s->tx.command & COMMAND_SF) != 0);
+ #endif
++
++ if (max_loop_count-- == 0) {
++ /* Prevent an endless loop. */
++ logout("loop in %s:%u\n", __FILE__, __LINE__);
++ break;
++ }
++
+ s->cu_offset = s->tx.link;
+ TRACE(OTHER,
+ logout("val=(cu start), status=0x%04x, command=0x%04x, link=0x%08x\n",
+--
+2.3.5
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index b5c717c..6c12bee 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -13,6 +13,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://CVE-2015-8504.patch \
file://CVE-2015-7504.patch \
file://CVE-2015-7512.patch \
+ file://CVE-2015-8345.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
2.3.5
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 5/6] qemu: Security fix CVE-2016-1568
2016-01-29 20:35 [PATCH 0/6][Jethro] Jethro-next qemu security fixes Armin Kuster
` (3 preceding siblings ...)
2016-01-29 20:35 ` [PATCH 4/6] qemu: Security fix CVE-2015-8345 Armin Kuster
@ 2016-01-29 20:35 ` Armin Kuster
2016-01-29 20:35 ` [PATCH 6/6] qemu: Security fix CVE-2015-7295 Armin Kuster
5 siblings, 0 replies; 7+ messages in thread
From: Armin Kuster @ 2016-01-29 20:35 UTC (permalink / raw)
To: openembedded-core, liezhi.yang
From: Armin Kuster <akuster@mvista.com>
CVE-2016-1568 Qemu: ide: ahci use-after-free vulnerability in aio port commands
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
.../recipes-devtools/qemu/qemu/CVE-2016-1568.patch | 46 ++++++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 1 +
2 files changed, 47 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-1568.patch
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-1568.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-1568.patch
new file mode 100644
index 0000000..9c40ffb
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2016-1568.patch
@@ -0,0 +1,46 @@
+From 4ab0359a8ae182a7ac5c99609667273167703fab Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Mon, 11 Jan 2016 14:10:42 -0500
+Subject: [PATCH] ide: ahci: reset ncq object to unused on error
+
+When processing NCQ commands, AHCI device emulation prepares a
+NCQ transfer object; To which an aio control block(aiocb) object
+is assigned in 'execute_ncq_command'. In case, when the NCQ
+command is invalid, the 'aiocb' object is not assigned, and NCQ
+transfer object is left as 'used'. This leads to a use after
+free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'.
+Reset NCQ transfer object to 'unused' to avoid it.
+
+[Maintainer edit: s/ACHI/AHCI/ in the commit message. --js]
+
+Reported-by: Qinghao Tang <luodalongde@gmail.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Reviewed-by: John Snow <jsnow@redhat.com>
+Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com
+Signed-off-by: John Snow <jsnow@redhat.com>
+
+Upstream-Status: Backport
+
+http://git.qemu.org/?p=qemu.git;a=commit;h=4ab0359a8ae182a7ac5c99609667273167703fab
+
+CVE: CVE-2016-1568
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/ide/ahci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+Index: qemu-2.4.0/hw/ide/ahci.c
+===================================================================
+--- qemu-2.4.0.orig/hw/ide/ahci.c
++++ qemu-2.4.0/hw/ide/ahci.c
+@@ -898,6 +898,7 @@ static void ncq_err(NCQTransferState *nc
+ ide_state->error = ABRT_ERR;
+ ide_state->status = READY_STAT | ERR_STAT;
+ ncq_tfs->drive->port_regs.scr_err |= (1 << ncq_tfs->tag);
++ ncq_tfs->used = 0;
+ }
+
+ static void ncq_finish(NCQTransferState *ncq_tfs)
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 6c12bee..6e6bd2b 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -14,6 +14,7 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://CVE-2015-7504.patch \
file://CVE-2015-7512.patch \
file://CVE-2015-8345.patch \
+ file://CVE-2016-1568.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
2.3.5
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 6/6] qemu: Security fix CVE-2015-7295
2016-01-29 20:35 [PATCH 0/6][Jethro] Jethro-next qemu security fixes Armin Kuster
` (4 preceding siblings ...)
2016-01-29 20:35 ` [PATCH 5/6] qemu: Security fix CVE-2016-1568 Armin Kuster
@ 2016-01-29 20:35 ` Armin Kuster
5 siblings, 0 replies; 7+ messages in thread
From: Armin Kuster @ 2016-01-29 20:35 UTC (permalink / raw)
To: openembedded-core, liezhi.yang
From: Armin Kuster <akuster@mvista.com>
CVE-2015-7295 Qemu: net: virtio-net possible remote DoS
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
.../qemu/qemu/CVE-2015-7295_1.patch | 63 ++++++++++++++++++++++
.../qemu/qemu/CVE-2015-7295_2.patch | 58 ++++++++++++++++++++
.../qemu/qemu/CVE-2015-7295_3.patch | 52 ++++++++++++++++++
meta/recipes-devtools/qemu/qemu_2.4.0.bb | 3 ++
4 files changed, 176 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch
new file mode 100644
index 0000000..d7ae871
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_1.patch
@@ -0,0 +1,63 @@
+From ce317461573bac12b10d67699b4ddf1f97cf066c Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 25 Sep 2015 13:21:28 +0800
+Subject: [PATCH] virtio: introduce virtqueue_unmap_sg()
+
+Factor out sg unmapping logic. This will be reused by the patch that
+can discard descriptor.
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Andrew James <andrew.james@hpe.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+Upstream-Status: Backport
+
+git.qemu.org/?p=qemu.git;a=commit;h=ce317461573bac12b10d67699b4ddf1f97cf066c
+
+CVE: CVE-2015-7295 patch #1
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/virtio/virtio.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+Index: qemu-2.4.0/hw/virtio/virtio.c
+===================================================================
+--- qemu-2.4.0.orig/hw/virtio/virtio.c
++++ qemu-2.4.0/hw/virtio/virtio.c
+@@ -243,14 +243,12 @@ int virtio_queue_empty(VirtQueue *vq)
+ return vring_avail_idx(vq) == vq->last_avail_idx;
+ }
+
+-void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+- unsigned int len, unsigned int idx)
++static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len)
+ {
+ unsigned int offset;
+ int i;
+
+- trace_virtqueue_fill(vq, elem, len, idx);
+-
+ offset = 0;
+ for (i = 0; i < elem->in_num; i++) {
+ size_t size = MIN(len - offset, elem->in_sg[i].iov_len);
+@@ -266,6 +264,14 @@ void virtqueue_fill(VirtQueue *vq, const
+ cpu_physical_memory_unmap(elem->out_sg[i].iov_base,
+ elem->out_sg[i].iov_len,
+ 0, elem->out_sg[i].iov_len);
++}
++
++void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len, unsigned int idx)
++{
++ trace_virtqueue_fill(vq, elem, len, idx);
++
++ virtqueue_unmap_sg(vq, elem, len);
+
+ idx = (idx + vring_used_idx(vq)) % vq->vring.num;
+
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch
new file mode 100644
index 0000000..45dfab3
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_2.patch
@@ -0,0 +1,58 @@
+From 29b9f5efd78ae0f9cc02dd169b6e80d2c404bade Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 25 Sep 2015 13:21:29 +0800
+Subject: [PATCH] virtio: introduce virtqueue_discard()
+
+This patch introduces virtqueue_discard() to discard a descriptor and
+unmap the sgs. This will be used by the patch that will discard
+descriptor when packet is truncated.
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Upstream-Status: Backport
+
+git.qemu.org/?p=qemu.git;a=commit;h=29b9f5efd78ae0f9cc02dd169b6e80d2c404bade
+
+CVE: CVE-2015-7295 patch #2
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/virtio/virtio.c | 7 +++++++
+ include/hw/virtio/virtio.h | 2 ++
+ 2 files changed, 9 insertions(+)
+
+Index: qemu-2.4.0/hw/virtio/virtio.c
+===================================================================
+--- qemu-2.4.0.orig/hw/virtio/virtio.c
++++ qemu-2.4.0/hw/virtio/virtio.c
+@@ -266,6 +266,13 @@ static void virtqueue_unmap_sg(VirtQueue
+ 0, elem->out_sg[i].iov_len);
+ }
+
++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len)
++{
++ vq->last_avail_idx--;
++ virtqueue_unmap_sg(vq, elem, len);
++}
++
+ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+ unsigned int len, unsigned int idx)
+ {
+Index: qemu-2.4.0/include/hw/virtio/virtio.h
+===================================================================
+--- qemu-2.4.0.orig/include/hw/virtio/virtio.h
++++ qemu-2.4.0/include/hw/virtio/virtio.h
+@@ -146,6 +146,8 @@ void virtio_del_queue(VirtIODevice *vdev
+ void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
+ unsigned int len);
+ void virtqueue_flush(VirtQueue *vq, unsigned int count);
++void virtqueue_discard(VirtQueue *vq, const VirtQueueElement *elem,
++ unsigned int len);
+ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
+ unsigned int len, unsigned int idx);
+
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch
new file mode 100644
index 0000000..74442e3
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2015-7295_3.patch
@@ -0,0 +1,52 @@
+From 0cf33fb6b49a19de32859e2cdc6021334f448fb3 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Fri, 25 Sep 2015 13:21:30 +0800
+Subject: [PATCH] virtio-net: correctly drop truncated packets
+
+When packet is truncated during receiving, we drop the packets but
+neither discard the descriptor nor add and signal used
+descriptor. This will lead several issues:
+
+- sg mappings are leaked
+- rx will be stalled if a lots of packets were truncated
+
+In order to be consistent with vhost, fix by discarding the descriptor
+in this case.
+
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+Upstream-Status: Backport
+
+git.qemu.org/?p=qemu.git;a=commit;h=0cf33fb6b49a19de32859e2cdc6021334f448fb3
+
+CVE: CVE-2015-7295 patch #3
+[Yocto # 9013]
+
+Signed-off-by: Armin Kuster <akuster@mvista.com>
+
+---
+ hw/net/virtio-net.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+Index: qemu-2.4.0/hw/net/virtio-net.c
+===================================================================
+--- qemu-2.4.0.orig/hw/net/virtio-net.c
++++ qemu-2.4.0/hw/net/virtio-net.c
+@@ -1086,13 +1086,7 @@ static ssize_t virtio_net_receive(NetCli
+ * must have consumed the complete packet.
+ * Otherwise, drop it. */
+ if (!n->mergeable_rx_bufs && offset < size) {
+-#if 0
+- error_report("virtio-net truncated non-mergeable packet: "
+- "i %zd mergeable %d offset %zd, size %zd, "
+- "guest hdr len %zd, host hdr len %zd",
+- i, n->mergeable_rx_bufs,
+- offset, size, n->guest_hdr_len, n->host_hdr_len);
+-#endif
++ virtqueue_discard(q->rx_vq, &elem, total);
+ return size;
+ }
+
diff --git a/meta/recipes-devtools/qemu/qemu_2.4.0.bb b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
index 6e6bd2b..994ddff 100644
--- a/meta/recipes-devtools/qemu/qemu_2.4.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_2.4.0.bb
@@ -15,6 +15,9 @@ SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
file://CVE-2015-7512.patch \
file://CVE-2015-8345.patch \
file://CVE-2016-1568.patch \
+ file://CVE-2015-7295_1.patch \
+ file://CVE-2015-7295_2.patch \
+ file://CVE-2015-7295_3.patch \
"
SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
SRC_URI[md5sum] = "186ee8194140a484a455f8e3c74589f4"
--
2.3.5
^ permalink raw reply related [flat|nested] 7+ messages in thread