[Qemu-devel] [PULL 0/1] Cve 2016 5403 virtio unbounded allocation patches

[Qemu-devel] [PULL 0/1] Cve 2016 5403 virtio unbounded allocation patches

[Stefan Hajnoczi]

The following changes since commit f49ee630d73729ecaeecf4b38a8df11bc613914d:

  Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.7-20160726' into staging (2016-07-26 11:53:47 +0100)

are available in the git repository at:

  git://github.com/stefanha/qemu.git tags/CVE-2016-5403-virtio-unbounded-allocation-pull-request

for you to fetch changes up to afd9096eb1882f23929f5b5c177898ed231bac66:

  virtio: error out if guest exceeds virtqueue size (2016-07-27 14:04:40 +0100)

----------------------------------------------------------------

----------------------------------------------------------------

Stefan Hajnoczi (1):
  virtio: error out if guest exceeds virtqueue size

 hw/virtio/virtio.c | 5 +++++
 1 file changed, 5 insertions(+)

-- 
2.7.4

[Qemu-devel] [PULL 1/1] virtio: error out if guest exceeds virtqueue size

[Stefan Hajnoczi]

A broken or malicious guest can submit more requests than the virtqueue
size permits, causing unbounded memory allocation in QEMU.

The guest can submit requests without bothering to wait for completion
and is therefore not bound by virtqueue size.  This requires reusing
vring descriptors in more than one request, which is not allowed by the
VIRTIO 1.0 specification.

In "3.2.1 Supplying Buffers to The Device", the VIRTIO 1.0 specification
says:

  1. The driver places the buffer into free descriptor(s) in the
     descriptor table, chaining as necessary

and

  Note that the above code does not take precautions against the
  available ring buffer wrapping around: this is not possible since the
  ring buffer is the same size as the descriptor table, so step (1) will
  prevent such a condition.

This implies that placing more buffers into the virtqueue than the
descriptor table size is not allowed.

QEMU is missing the check to prevent this case.  Processing a request
allocates a VirtQueueElement leading to unbounded memory allocation
controlled by the guest.

Exit with an error if the guest provides more requests than the
virtqueue size permits.  This bounds memory allocation and makes the
buggy guest visible to the user.

This patch fixes CVE-2016-5403 and was reported by Zhenhao Hong from 360
Marvel Team, China.

Reported-by: Zhenhao Hong <hongzhenhao@360.cn>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/virtio/virtio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 752b271..28cf504 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -562,6 +562,11 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
 
     max = vq->vring.num;
 
+    if (vq->inuse >= vq->vring.num) {
+        error_report("Virtqueue size exceeded");
+        exit(1);
+    }
+
     i = head = virtqueue_get_head(vq, vq->last_avail_idx++);
     if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
         vring_set_avail_event(vq, vq->last_avail_idx);
-- 
2.7.4

Re: [Qemu-devel] [PULL 0/1] Cve 2016 5403 virtio unbounded allocation patches

[Peter Maydell]

On 27 July 2016 at 17:43, Stefan Hajnoczi <stefanha@redhat.com> wrote:
> The following changes since commit f49ee630d73729ecaeecf4b38a8df11bc613914d:
>
>   Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-2.7-20160726' into staging (2016-07-26 11:53:47 +0100)
>
> are available in the git repository at:
>
>   git://github.com/stefanha/qemu.git tags/CVE-2016-5403-virtio-unbounded-allocation-pull-request
>
> for you to fetch changes up to afd9096eb1882f23929f5b5c177898ed231bac66:
>
>   virtio: error out if guest exceeds virtqueue size (2016-07-27 14:04:40 +0100)
>
> ----------------------------------------------------------------
>
> ----------------------------------------------------------------
>
> Stefan Hajnoczi (1):
>   virtio: error out if guest exceeds virtqueue size
>
>  hw/virtio/virtio.c | 5 +++++
>  1 file changed, 5 insertions(+)

Applied, thanks.

-- PMM