[Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun

[Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun

[Michael S. Tsirkin]

When VM guest programs multicast addresses for
a virtio net card, it supplies a 32 bit
entries counter for the number of addresses.
These addresses are read into tail portion of
a fixed macs array which has size MAC_TABLE_ENTRIES,
at offset equal to in_use.

To avoid overflow of this array by guest, qemu attempts
to test the size as follows:
-    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {

however, as mac_data.entries is uint32_t, this sum
can overflow, e.g. if in_use is 1 and mac_data.entries
is 0xffffffff then in_use + mac_data.entries will be 0.

Qemu will then read guest supplied buffer into this
memory, overflowing buffer on heap.

CVE-2014-0150

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---

Passed basic tests.
CVE fix so pick this up for -rc3?

 hw/net/virtio-net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 439477b..33bd233 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -677,7 +677,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
         goto error;
     }
 
-    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
+    if (mac_data.entries <= MAC_TABLE_ENTRIES - in_use) {
         s = iov_to_buf(iov, iov_cnt, 0, &macs[in_use * ETH_ALEN],
                        mac_data.entries * ETH_ALEN);
         if (s != mac_data.entries * ETH_ALEN) {
-- 
MST

Re: [Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun

[Michael Tokarev]

11.04.2014 16:18, Michael S. Tsirkin wrote:
> When VM guest programs multicast addresses for
> a virtio net card, it supplies a 32 bit
> entries counter for the number of addresses.
> These addresses are read into tail portion of
> a fixed macs array which has size MAC_TABLE_ENTRIES,
> at offset equal to in_use.
> 
> To avoid overflow of this array by guest, qemu attempts
> to test the size as follows:
> -    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
> 
> however, as mac_data.entries is uint32_t, this sum
> can overflow, e.g. if in_use is 1 and mac_data.entries
> is 0xffffffff then in_use + mac_data.entries will be 0.
> 
> Qemu will then read guest supplied buffer into this
> memory, overflowing buffer on heap.
> 
> CVE-2014-0150
> 
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

> Passed basic tests.
> CVE fix so pick this up for -rc3?
> 
>  hw/net/virtio-net.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index 439477b..33bd233 100644
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -677,7 +677,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
>          goto error;
>      }
>  
> -    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
> +    if (mac_data.entries <= MAC_TABLE_ENTRIES - in_use) {
>          s = iov_to_buf(iov, iov_cnt, 0, &macs[in_use * ETH_ALEN],
>                         mac_data.entries * ETH_ALEN);
>          if (s != mac_data.entries * ETH_ALEN) {
> 

Re: [Qemu-devel] [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun

[Peter Maydell]

On 11 April 2014 15:21, Michael Tokarev <mjt@tls.msk.ru> wrote:
> 11.04.2014 16:18, Michael S. Tsirkin wrote:
>> When VM guest programs multicast addresses for
>> a virtio net card, it supplies a 32 bit
>> entries counter for the number of addresses.
>> These addresses are read into tail portion of
>> a fixed macs array which has size MAC_TABLE_ENTRIES,
>> at offset equal to in_use.
>>
>> To avoid overflow of this array by guest, qemu attempts
>> to test the size as follows:
>> -    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
>>
>> however, as mac_data.entries is uint32_t, this sum
>> can overflow, e.g. if in_use is 1 and mac_data.entries
>> is 0xffffffff then in_use + mac_data.entries will be 0.
>>
>> Qemu will then read guest supplied buffer into this
>> memory, overflowing buffer on heap.
>>
>> CVE-2014-0150
>>
>> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>
> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

Applied, thanks. (This is not the clearest code in the world
given we wait so late to validate the value from the guest
but it looks right to me.)

I added a cc: stable too.

-- PMM