[Qemu-devel] [PULL v2 0/1] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

[Qemu-devel] [PULL v2 0/1] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

[Gerd Hoffmann]

  Hi,

v2, this time with qemu-stable Cc'ed.

please pull,
  Gerd

The following changes since commit 10f25e4844cb9b3f02fb032f88051dd5b65b4206:

  Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170222' into staging (2017-02-23 09:59:40 +0000)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-cve-2017-2620-20170224-1

for you to fetch changes up to 92f2b88cea48c6aeba8de568a45f2ed958f3c298:

  cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620) (2017-02-24 14:35:50 +0100)

----------------------------------------------------------------
cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

----------------------------------------------------------------
Gerd Hoffmann (1):
      cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

 hw/display/cirrus_vga.c | 8 ++++++++
 1 file changed, 8 insertions(+)

[Qemu-devel] [PULL 1/1] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

[Gerd Hoffmann]

CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
and blit width, at all.  Oops.  Fix it.

Security impact: high.

The missing blit destination check allows to write to host memory.
Basically same as CVE-2014-8106 for the other blit variants.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/cirrus_vga.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 1deb520..b9e7cb1 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -900,6 +900,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
 {
     int w;
 
+    if (blit_is_unsafe(s, true)) {
+        return 0;
+    }
+
     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
@@ -925,6 +929,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
 	}
         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
     }
+
+    /* the blit_is_unsafe call above should catch this */
+    assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
+
     s->cirrus_srcptr = s->cirrus_bltbuf;
     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
     cirrus_update_memory_access(s);
-- 
1.8.3.1

Re: [Qemu-devel] [PULL v2 0/1] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

[Peter Maydell]

On 24 February 2017 at 13:44, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> v2, this time with qemu-stable Cc'ed.
>
> please pull,
>   Gerd
>
> The following changes since commit 10f25e4844cb9b3f02fb032f88051dd5b65b4206:
>
>   Merge remote-tracking branch 'remotes/yongbok/tags/mips-20170222' into staging (2017-02-23 09:59:40 +0000)
>
> are available in the git repository at:
>
>
>   git://git.kraxel.org/qemu tags/pull-cve-2017-2620-20170224-1
>
> for you to fetch changes up to 92f2b88cea48c6aeba8de568a45f2ed958f3c298:
>
>   cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620) (2017-02-24 14:35:50 +0100)
>
> ----------------------------------------------------------------
> cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)
>
> ----------------------------------------------------------------
> Gerd Hoffmann (1):
>       cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)
>
>  hw/display/cirrus_vga.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/1] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

[Gerd Hoffmann]

  Hi,

Here is the pull request for the cirrus cve
fix sent to the list yesterday.

please pull,
  Gerd

The following changes since commit 796b288f7be875045670f963ce99991b3c8e96ac:

  Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2017-02-21 15:48:22 +0000)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-cve-2017-2620-20170222-1

for you to fetch changes up to c4cf7039465b0578035c4ec82f9f2519f7dceaf3:

  cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620) (2017-02-22 12:57:08 +0100)

----------------------------------------------------------------
cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

----------------------------------------------------------------
Gerd Hoffmann (1):
      cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

 hw/display/cirrus_vga.c | 8 ++++++++
 1 file changed, 8 insertions(+)

[Qemu-devel] [PULL 1/1] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

[Gerd Hoffmann]

CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
and blit width, at all.  Oops.  Fix it.

Security impact: high.

The missing blit destination check allows to write to host memory.
Basically same as CVE-2014-8106 for the other blit variants.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1487679663-3264-1-git-send-email-kraxel@redhat.com
---
 hw/display/cirrus_vga.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 1deb520..b9e7cb1 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -900,6 +900,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
 {
     int w;
 
+    if (blit_is_unsafe(s, true)) {
+        return 0;
+    }
+
     s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
     s->cirrus_srcptr = &s->cirrus_bltbuf[0];
     s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
@@ -925,6 +929,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
 	}
         s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
     }
+
+    /* the blit_is_unsafe call above should catch this */
+    assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
+
     s->cirrus_srcptr = s->cirrus_bltbuf;
     s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
     cirrus_update_memory_access(s);
-- 
1.8.3.1