From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49331) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZKm85-0006q5-ER for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:36:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZKm81-0002t3-Oc for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:36:05 -0400 Received: from e17.ny.us.ibm.com ([129.33.205.207]:39415) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZKm81-0002sk-Jz for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:36:01 -0400 Received: from /spool/local by e17.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 30 Jul 2015 07:36:01 -0400 From: Michael Roth Date: Thu, 30 Jul 2015 06:33:06 -0500 Message-Id: <1438255988-10418-52-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1438255988-10418-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1438255988-10418-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 51/53] ide: Check array bounds before writing to io_buffer (CVE-2015-5154) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , qemu-stable@nongnu.org From: Kevin Wolf If the end_transfer_func of a command is called because enough data has been read or written for the current PIO transfer, and it fails to correctly call the command completion functions, the DRQ bit in the status register and s->end_transfer_func may remain set. This allows the guest to access further bytes in s->io_buffer beyond s->data_end, and eventually overflowing the io_buffer. One case where this currently happens is emulation of the ATAPI command START STOP UNIT. This patch fixes the problem by adding explicit array bounds checks before accessing the buffer instead of relying on end_transfer_func to function correctly. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf Reviewed-by: John Snow (cherry picked from commit d2ff85854512574e7209f295e87b0835d5b032c6) Signed-off-by: Michael Roth --- hw/ide/core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/hw/ide/core.c b/hw/ide/core.c index a895fd8..17153f5 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -2021,6 +2021,10 @@ void ide_data_writew(void *opaque, uint32_t addr, uint32_t val) } p = s->data_ptr; + if (p + 2 > s->data_end) { + return; + } + *(uint16_t *)p = le16_to_cpu(val); p += 2; s->data_ptr = p; @@ -2042,6 +2046,10 @@ uint32_t ide_data_readw(void *opaque, uint32_t addr) } p = s->data_ptr; + if (p + 2 > s->data_end) { + return 0; + } + ret = cpu_to_le16(*(uint16_t *)p); p += 2; s->data_ptr = p; @@ -2063,6 +2071,10 @@ void ide_data_writel(void *opaque, uint32_t addr, uint32_t val) } p = s->data_ptr; + if (p + 4 > s->data_end) { + return; + } + *(uint32_t *)p = le32_to_cpu(val); p += 4; s->data_ptr = p; @@ -2084,6 +2096,10 @@ uint32_t ide_data_readl(void *opaque, uint32_t addr) } p = s->data_ptr; + if (p + 4 > s->data_end) { + return 0; + } + ret = cpu_to_le32(*(uint32_t *)p); p += 4; s->data_ptr = p; -- 1.9.1