From: Kevin Wolf <kwolf@redhat.com>
To: Felipe Franciosi <felipe@nutanix.com>
Cc: Peter Turschmid <peter.turschm@nutanix.com>,
Stefan Hajnoczi <stefanha@redhat.com>,
"qemu-block@nongnu.org" <qemu-block@nongnu.org>,
Peter Lieven <pl@kamp.de>,
"qemu-devel@nongnu.org" <qemu-devel@nongnu.org>,
"qemu-stable@nongnu.org" <qemu-stable@nongnu.org>,
P J P <ppandit@redhat.com>, Max Reitz <mreitz@redhat.com>,
Ronnie Sahlberg <ronniesahlberg@gmail.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Raphael Norwitz <raphael.norwitz@nutanix.com>
Subject: Re: [PATCH] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
Date: Thu, 23 Jan 2020 17:59:55 +0100 [thread overview]
Message-ID: <20200123165955.GB5021@linux.fritz.box> (raw)
In-Reply-To: <20200123124357.124019-1-felipe@nutanix.com>
Am 23.01.2020 um 13:44 hat Felipe Franciosi geschrieben:
> When querying an iSCSI server for the provisioning status of blocks (via
> GET LBA STATUS), Qemu only validates that the response descriptor zero's
> LBA matches the one requested. Given the SCSI spec allows servers to
> respond with the status of blocks beyond the end of the LUN, Qemu may
> have its heap corrupted by clearing/setting too many bits at the end of
> its allocmap for the LUN.
>
> A malicious guest in control of the iSCSI server could carefully program
> Qemu's heap (by selectively setting the bitmap) and then smash it.
>
> This limits the number of bits that iscsi_co_block_status() will try to
> update in the allocmap so it can't overflow the bitmap.
>
> Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
> Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com>
> Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Thanks, applied to the block branch.
Kevin
next prev parent reply other threads:[~2020-01-23 19:31 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-23 12:44 [PATCH] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) Felipe Franciosi
2020-01-23 16:59 ` Kevin Wolf [this message]
2020-01-28 12:30 ` Philippe Mathieu-Daudé
2020-01-28 12:42 ` Kevin Wolf
2020-02-05 14:22 ` Felipe Franciosi
2020-01-23 17:46 ` Philippe Mathieu-Daudé
2020-01-23 21:29 ` Felipe Franciosi
2020-01-23 22:58 ` Peter Lieven
2020-01-24 10:04 ` Philippe Mathieu-Daudé
2020-01-24 10:48 ` Felipe Franciosi
2020-01-24 13:39 ` Kevin Wolf
2020-01-24 13:42 ` Philippe Mathieu-Daudé
2020-01-24 13:52 ` Kevin Wolf
2020-01-24 14:24 ` Philippe Mathieu-Daudé
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200123165955.GB5021@linux.fritz.box \
--to=kwolf@redhat.com \
--cc=felipe@nutanix.com \
--cc=mreitz@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.turschm@nutanix.com \
--cc=pl@kamp.de \
--cc=ppandit@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
--cc=raphael.norwitz@nutanix.com \
--cc=ronniesahlberg@gmail.com \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).