[Qemu-devel] [PATCH for 2.5 1/2] net: pcnet: add check to validate receive data size(CVE-2015-7504)

[Qemu-devel] [PATCH for 2.5 1/2] net: pcnet: add check to validate receive data size(CVE-2015-7504)

[Jason Wang]

From: Prasad J Pandit <pjp@fedoraproject.org>

In loopback mode, pcnet_receive routine appends CRC code to the
receive buffer. If the data size given is same as the buffer size,
the appended CRC code overwrites 4 bytes after s->buffer. Added a
check to avoid that.

Reported by: Qinghao Tang <luodalongde@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/pcnet.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index 0eb3cc4..309c40b 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
                 uint32_t fcs = ~0;
                 uint8_t *p = src;
 
-                while (p != &src[size-4])
+                while (p != &src[size])
                     CRC(fcs, *p++);
                 crc_err = (*(uint32_t *)p != htonl(fcs));
             }
@@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s)
         bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
 
         /* if multi-tmd packet outsizes s->buffer then skip it silently.
-           Note: this is not what real hw does */
-        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
+         * Note: this is not what real hw does.
+         * Last four bytes of s->buffer are used to store CRC FCS code.
+         */
+        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
             s->xmit_pos = -1;
             goto txdone;
         }
-- 
2.5.0

[Qemu-devel] [PATCH for 2.5 2/2] pcnet: fix rx buffer overflow(CVE-2015-7512)

[Jason Wang]

Backends could provide a packet whose length is greater than buffer
size. Check for this and truncate the packet to avoid rx buffer
overflow in this case.

Cc: Prasad J Pandit <pjp@fedoraproject.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/pcnet.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index 309c40b..1f4a3db 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
             int pktcount = 0;
 
             if (!s->looptest) {
+                if (size > 4092) {
+#ifdef PCNET_DEBUG_RMD
+                    fprintf(stderr, "pcnet: truncates rx packet.\n");
+#endif
+                    size = 4092;
+                }
                 memcpy(src, buf, size);
                 /* no need to compute the CRC */
                 src[size] = 0;
-- 
2.5.0

Re: [Qemu-devel] [PATCH for 2.5 2/2] pcnet: fix rx buffer overflow(CVE-2015-7512)

[Michael S. Tsirkin]

On Mon, Nov 30, 2015 at 03:38:23PM +0800, Jason Wang wrote:
> Backends could provide a packet whose length is greater than buffer
> size. Check for this and truncate the packet to avoid rx buffer
> overflow in this case.
> 
> Cc: Prasad J Pandit <pjp@fedoraproject.org>
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Jason Wang <jasowang@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/net/pcnet.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
> index 309c40b..1f4a3db 100644
> --- a/hw/net/pcnet.c
> +++ b/hw/net/pcnet.c
> @@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
>              int pktcount = 0;
>  
>              if (!s->looptest) {
> +                if (size > 4092) {
> +#ifdef PCNET_DEBUG_RMD
> +                    fprintf(stderr, "pcnet: truncates rx packet.\n");
> +#endif
> +                    size = 4092;
> +                }
>                  memcpy(src, buf, size);
>                  /* no need to compute the CRC */
>                  src[size] = 0;
> -- 
> 2.5.0
> 

Re: [Qemu-devel] [PATCH for 2.5 2/2] pcnet: fix rx buffer overflow(CVE-2015-7512)

[Jason Wang]

On 11/30/2015 06:46 PM, Michael S. Tsirkin wrote:
> On Mon, Nov 30, 2015 at 03:38:23PM +0800, Jason Wang wrote:
>> Backends could provide a packet whose length is greater than buffer
>> size. Check for this and truncate the packet to avoid rx buffer
>> overflow in this case.
>>
>> Cc: Prasad J Pandit <pjp@fedoraproject.org>
>> Cc: qemu-stable@nongnu.org
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Applied to my -net. Thanks.

>
>> ---
>>  hw/net/pcnet.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
>> index 309c40b..1f4a3db 100644
>> --- a/hw/net/pcnet.c
>> +++ b/hw/net/pcnet.c
>> @@ -1064,6 +1064,12 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
>>              int pktcount = 0;
>>  
>>              if (!s->looptest) {
>> +                if (size > 4092) {
>> +#ifdef PCNET_DEBUG_RMD
>> +                    fprintf(stderr, "pcnet: truncates rx packet.\n");
>> +#endif
>> +                    size = 4092;
>> +                }
>>                  memcpy(src, buf, size);
>>                  /* no need to compute the CRC */
>>                  src[size] = 0;
>> -- 
>> 2.5.0
>>

Re: [Qemu-devel] [PATCH for 2.5 1/2] net: pcnet: add check to validate receive data size(CVE-2015-7504)

[Michael S. Tsirkin]

On Mon, Nov 30, 2015 at 03:38:22PM +0800, Jason Wang wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> In loopback mode, pcnet_receive routine appends CRC code to the
> receive buffer. If the data size given is same as the buffer size,
> the appended CRC code overwrites 4 bytes after s->buffer. Added a
> check to avoid that.
> 
> Reported by: Qinghao Tang <luodalongde@gmail.com>
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> Signed-off-by: Jason Wang <jasowang@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> ---
>  hw/net/pcnet.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
> index 0eb3cc4..309c40b 100644
> --- a/hw/net/pcnet.c
> +++ b/hw/net/pcnet.c
> @@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
>                  uint32_t fcs = ~0;
>                  uint8_t *p = src;
>  
> -                while (p != &src[size-4])
> +                while (p != &src[size])
>                      CRC(fcs, *p++);
>                  crc_err = (*(uint32_t *)p != htonl(fcs));
>              }
> @@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s)
>          bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
>  
>          /* if multi-tmd packet outsizes s->buffer then skip it silently.
> -           Note: this is not what real hw does */
> -        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
> +         * Note: this is not what real hw does.
> +         * Last four bytes of s->buffer are used to store CRC FCS code.
> +         */
> +        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
>              s->xmit_pos = -1;
>              goto txdone;
>          }
> -- 
> 2.5.0
> 

Re: [Qemu-devel] [PATCH for 2.5 1/2] net: pcnet: add check to validate receive data size(CVE-2015-7504)

[Jason Wang]

On 11/30/2015 06:46 PM, Michael S. Tsirkin wrote:
> On Mon, Nov 30, 2015 at 03:38:22PM +0800, Jason Wang wrote:
>> From: Prasad J Pandit <pjp@fedoraproject.org>
>>
>> In loopback mode, pcnet_receive routine appends CRC code to the
>> receive buffer. If the data size given is same as the buffer size,
>> the appended CRC code overwrites 4 bytes after s->buffer. Added a
>> check to avoid that.
>>
>> Reported by: Qinghao Tang <luodalongde@gmail.com>
>> Cc: qemu-stable@nongnu.org
>> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Applied to my -net. Thanks

>> ---
>>  hw/net/pcnet.c | 8 +++++---
>>  1 file changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
>> index 0eb3cc4..309c40b 100644
>> --- a/hw/net/pcnet.c
>> +++ b/hw/net/pcnet.c
>> @@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
>>                  uint32_t fcs = ~0;
>>                  uint8_t *p = src;
>>  
>> -                while (p != &src[size-4])
>> +                while (p != &src[size])
>>                      CRC(fcs, *p++);
>>                  crc_err = (*(uint32_t *)p != htonl(fcs));
>>              }
>> @@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s)
>>          bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT);
>>  
>>          /* if multi-tmd packet outsizes s->buffer then skip it silently.
>> -           Note: this is not what real hw does */
>> -        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
>> +         * Note: this is not what real hw does.
>> +         * Last four bytes of s->buffer are used to store CRC FCS code.
>> +         */
>> +        if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) {
>>              s->xmit_pos = -1;
>>              goto txdone;
>>          }
>> -- 
>> 2.5.0
>>