From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58006) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WYaPk-0001Ri-Uo for qemu-devel@nongnu.org; Fri, 11 Apr 2014 08:18:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WYaPb-0002sN-WC for qemu-devel@nongnu.org; Fri, 11 Apr 2014 08:18:36 -0400 Received: from mx1.redhat.com ([209.132.183.28]:29667) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WYaPb-0002sC-O2 for qemu-devel@nongnu.org; Fri, 11 Apr 2014 08:18:27 -0400 Date: Fri, 11 Apr 2014 15:18:08 +0300 From: "Michael S. Tsirkin" Message-ID: <1397218574-25058-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Anthony Liguori When VM guest programs multicast addresses for a virtio net card, it supplies a 32 bit entries counter for the number of addresses. These addresses are read into tail portion of a fixed macs array which has size MAC_TABLE_ENTRIES, at offset equal to in_use. To avoid overflow of this array by guest, qemu attempts to test the size as follows: - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { however, as mac_data.entries is uint32_t, this sum can overflow, e.g. if in_use is 1 and mac_data.entries is 0xffffffff then in_use + mac_data.entries will be 0. Qemu will then read guest supplied buffer into this memory, overflowing buffer on heap. CVE-2014-0150 Signed-off-by: Michael S. Tsirkin --- Passed basic tests. CVE fix so pick this up for -rc3? hw/net/virtio-net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 439477b..33bd233 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -677,7 +677,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd, goto error; } - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { + if (mac_data.entries <= MAC_TABLE_ENTRIES - in_use) { s = iov_to_buf(iov, iov_cnt, 0, &macs[in_use * ETH_ALEN], mac_data.entries * ETH_ALEN); if (s != mac_data.entries * ETH_ALEN) { -- MST