[Qemu-devel] [PULL 0/1] Vga 20180125 patches

[Qemu-devel] [PULL 0/1] Vga 20180125 patches

[Gerd Hoffmann]

The following changes since commit 834a336eb911db8a8ca00e760ee6a85faca19414:

  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2018-01-24 19:24:26 +0000)

are available in the git repository at:

  git://git.kraxel.org/qemu tags/vga-20180125-pull-request

for you to fetch changes up to 191f59dc17396bb5a8da50f8c59b6e0a430711a4:

  vga: check the validation of memory addr when draw text (2018-01-25 10:18:39 +0100)

----------------------------------------------------------------
vga: fix for CVE-2018-5683

----------------------------------------------------------------

linzhecheng (1):
  vga: check the validation of memory addr when draw text

 hw/display/vga.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.9.3

[Qemu-devel] [PULL 1/1] vga: check the validation of memory addr when draw text

[Gerd Hoffmann]

From: linzhecheng <linzhecheng@huawei.com>

Start a vm with qemu-kvm -enable-kvm -vnc :66 -smp 1 -m 1024 -hda
redhat_5.11.qcow2  -device pcnet -vga cirrus,
then use VNC client to connect to VM, and excute the code below in guest
OS will lead to qemu crash:

int main()
 {
    iopl(3);
    srand(time(NULL));
    int a,b;
    while(1){
	a = rand()%0x100;
	b = 0x3c0 + (rand()%0x20);
        outb(a,b);
    }
    return 0;
}

The above code is writing the registers of VGA randomly.
We can write VGA CRT controller registers index 0x0C or 0x0D
(which is the start address register) to modify the
the display memory address of the upper left pixel
or character of the screen. The address may be out of the
range of vga ram. So we should check the validation of memory address
when reading or writing it to avoid segfault.

Signed-off-by: linzhecheng <linzhecheng@huawei.com>
Message-id: 20180111132724.13744-1-linzhecheng@huawei.com
Fixes: CVE-2018-5683
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/vga.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/display/vga.c b/hw/display/vga.c
index a0412000a5..6e78a4e156 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -1279,6 +1279,9 @@ static void vga_draw_text(VGACommonState *s, int full_update)
         cx_min = width;
         cx_max = -1;
         for(cx = 0; cx < width; cx++) {
+            if (src + sizeof(uint16_t) > s->vram_ptr + s->vram_size) {
+                break;
+            }
             ch_attr = *(uint16_t *)src;
             if (full_update || ch_attr != *ch_attr_ptr || src == cursor_ptr) {
                 if (cx < cx_min)
-- 
2.9.3

Re: [Qemu-devel] [PULL 0/1] Vga 20180125 patches

[Peter Maydell]

On 25 January 2018 at 09:34, Gerd Hoffmann <kraxel@redhat.com> wrote:
> The following changes since commit 834a336eb911db8a8ca00e760ee6a85faca19414:
>
>   Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2018-01-24 19:24:26 +0000)
>
> are available in the git repository at:
>
>   git://git.kraxel.org/qemu tags/vga-20180125-pull-request
>
> for you to fetch changes up to 191f59dc17396bb5a8da50f8c59b6e0a430711a4:
>
>   vga: check the validation of memory addr when draw text (2018-01-25 10:18:39 +0100)
>
> ----------------------------------------------------------------
> vga: fix for CVE-2018-5683
>
> ----------------------------------------------------------------
>
> linzhecheng (1):
>   vga: check the validation of memory addr when draw text
>
>  hw/display/vga.c | 3 +++
>  1 file changed, 3 insertions(+)

Applied, thanks.

-- PMM