From: "Michael S. Tsirkin" <mst@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: "Michael Roth" <mdroth@linux.vnet.ibm.com>,
"Juan Quintela" <quintela@redhat.com>,
"Alexey Kardashevskiy" <aik@ozlabs.ru>,
qemu-stable <qemu-stable@nongnu.org>,
"QEMU Developers" <qemu-devel@nongnu.org>,
"Anthony Liguori" <anthony@codemonkey.ws>,
"Andreas Färber" <afaerber@suse.de>,
"Dave Gilbert" <dgilbert@redhat.com>
Subject: Re: [Qemu-devel] [PATCH v4 12/30] vmstate: fix buffer overflow in target-arm/machine.c
Date: Tue, 1 Apr 2014 18:12:52 +0300 [thread overview]
Message-ID: <20140401151252.GA9260@redhat.com> (raw)
In-Reply-To: <CAFEAcA8fsRikwSMqsEHEzkcM9N-ao+icntkRnk7nrqWEX=uNew@mail.gmail.com>
On Mon, Mar 31, 2014 at 04:40:41PM +0100, Peter Maydell wrote:
> On 31 March 2014 15:16, Michael S. Tsirkin <mst@redhat.com> wrote:
> > CVE-2013-4531
> >
> > cpreg_vmstate_indexes is a VARRAY_INT32. A negative value for
> > cpreg_vmstate_array_len will cause a buffer overflow.
> >
> > VMSTATE_INT32_LE was supposed to protect against this
> > but doesn't because it doesn't validate that input is
> > non-negative.
> >
> > Fix this macro to valide the value appropriately.
> >
> > The only other user of VMSTATE_INT32_LE doesn't
> > ever use negative numbers so it doesn't care.
>
> This fixes the bug, but it's rather unintuitive semantics
> for an INT32_LE not to simply do a signed comparison...
> Maybe rename the macro?
>
> thanks
> -- PMM
Sure. I'll do it in a separate patch though.
next prev parent reply other threads:[~2014-04-01 15:13 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-31 14:15 [Qemu-devel] [PATCH v4 00/30] qemu state loading issues Michael S. Tsirkin
2014-03-31 14:15 ` [Qemu-devel] [PATCH v4 01/30] vmstate: reduce code duplication Michael S. Tsirkin
2014-03-31 15:01 ` Dr. David Alan Gilbert
2014-03-31 15:27 ` Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 02/30] vmstate: add VMS_MUST_EXIST Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 03/30] vmstate: add VMSTATE_VALIDATE Michael S. Tsirkin
2014-04-01 10:39 ` Dr. David Alan Gilbert
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 04/30] virtio-net: fix buffer overflow on invalid state load Michael S. Tsirkin
2014-03-31 17:21 ` Laszlo Ersek
2014-03-31 19:34 ` Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 05/30] virtio-net: out-of-bounds buffer write on load Michael S. Tsirkin
2014-04-01 8:45 ` Dr. David Alan Gilbert
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 06/30] virtio-net: out-of-bounds buffer write on invalid state load Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 07/30] virtio: " Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 08/30] ahci: fix buffer overrun " Michael S. Tsirkin
2014-03-31 15:31 ` Peter Maydell
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 09/30] hpet: " Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 10/30] hw/pci/pcie_aer.c: fix buffer overruns " Michael S. Tsirkin
2014-04-01 10:56 ` Dr. David Alan Gilbert
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 11/30] pl022: fix buffer overun " Michael S. Tsirkin
2014-03-31 15:04 ` Peter Maydell
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 12/30] vmstate: fix buffer overflow in target-arm/machine.c Michael S. Tsirkin
2014-03-31 15:40 ` Peter Maydell
2014-04-01 15:12 ` Michael S. Tsirkin [this message]
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 13/30] stellaris_enet: avoid buffer overrun on incoming migration Michael S. Tsirkin
2014-03-31 17:11 ` Dr. David Alan Gilbert
2014-03-31 20:49 ` Michael S. Tsirkin
2014-03-31 21:13 ` Peter Maydell
2014-04-01 15:19 ` Michael S. Tsirkin
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 14/30] stellaris_enet: avoid buffer overrun on incoming migration (part 2) Michael S. Tsirkin
2014-04-01 9:43 ` Dr. David Alan Gilbert
2014-04-01 10:05 ` Peter Maydell
2014-04-01 11:52 ` Peter Maydell
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 15/30] stellaris_enet: avoid buffer orerrun on incoming migration (part 3) Michael S. Tsirkin
2014-04-01 9:51 ` Dr. David Alan Gilbert
2014-04-01 10:06 ` Peter Maydell
2014-04-01 15:22 ` Michael S. Tsirkin
2014-04-01 15:56 ` Peter Maydell
2014-04-01 14:42 ` Eric Blake
2014-03-31 14:16 ` [Qemu-devel] [PATCH v4 16/30] virtio: avoid buffer overrun on incoming migration Michael S. Tsirkin
2014-03-31 16:09 ` Peter Maydell
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 17/30] openpic: " Michael S. Tsirkin
2014-03-31 15:55 ` Peter Maydell
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 18/30] virtio: validate num_sg when mapping Michael S. Tsirkin
2014-04-01 9:10 ` Amit Shah
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 19/30] pxa2xx: avoid buffer overrun on incoming migration Michael S. Tsirkin
2014-03-31 15:29 ` Peter Maydell
2014-03-31 17:26 ` Don Koch
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 20/30] ssi-sd: fix buffer overrun on invalid state load Michael S. Tsirkin
2014-03-31 15:44 ` Peter Maydell
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 21/30] ssd0323: fix buffer overun " Michael S. Tsirkin
2014-03-31 15:35 ` Peter Maydell
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 22/30] tsc210x: fix buffer overrun " Michael S. Tsirkin
2014-03-31 15:39 ` Peter Maydell
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 23/30] zaurus: " Michael S. Tsirkin
2014-04-01 11:18 ` Dr. David Alan Gilbert
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 24/30] usb: sanity check setup_index+setup_len in post_load Michael S. Tsirkin
2014-03-31 15:48 ` Peter Maydell
2014-04-01 6:23 ` Gerd Hoffmann
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 25/30] virtio-scsi: fix buffer overrun on invalid state load Michael S. Tsirkin
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 26/30] savevm: fix potential segfault on invalid state Michael S. Tsirkin
2014-03-31 16:04 ` Peter Maydell
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 27/30] vmxnet3: validate interrupt indices coming from guest Michael S. Tsirkin
2014-03-31 15:45 ` Dr. David Alan Gilbert
2014-04-01 9:54 ` Dmitry Fleytman
2014-04-01 10:03 ` Dr. David Alan Gilbert
2014-04-01 11:33 ` Dr. David Alan Gilbert
2014-04-01 13:04 ` Dmitry Fleytman
2014-04-01 13:07 ` Dr. David Alan Gilbert
2014-04-03 16:07 ` Michael S. Tsirkin
2014-04-04 9:47 ` Dmitry Fleytman
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 28/30] vmxnet3: validate interrupt indices read on migration Michael S. Tsirkin
2014-03-31 16:33 ` Dr. David Alan Gilbert
2014-03-31 19:38 ` Michael S. Tsirkin
2014-04-01 10:15 ` Dmitry Fleytman
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 29/30] vmxnet3: validate queues configuration coming from quest Michael S. Tsirkin
2014-03-31 15:48 ` Dr. David Alan Gilbert
2014-04-01 10:04 ` Dmitry Fleytman
2014-04-01 14:52 ` Michael S. Tsirkin
2014-04-01 18:40 ` Dmitry Fleytman
2014-03-31 14:17 ` [Qemu-devel] [PATCH v4 30/30] vmxnet3: validate queues configuration read on migration Michael S. Tsirkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140401151252.GA9260@redhat.com \
--to=mst@redhat.com \
--cc=afaerber@suse.de \
--cc=aik@ozlabs.ru \
--cc=anthony@codemonkey.ws \
--cc=dgilbert@redhat.com \
--cc=mdroth@linux.vnet.ibm.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
--cc=quintela@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).