From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:60573) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RikCJ-0001aO-Hd for qemu-devel@nongnu.org; Thu, 05 Jan 2012 05:05:32 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RikCI-0005ii-6I for qemu-devel@nongnu.org; Thu, 05 Jan 2012 05:05:23 -0500 Received: from lo.gmane.org ([80.91.229.12]:54532) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RikCH-0005iJ-QQ for qemu-devel@nongnu.org; Thu, 05 Jan 2012 05:05:22 -0500 Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1RikCF-0003jA-VH for qemu-devel@nongnu.org; Thu, 05 Jan 2012 11:05:19 +0100 Received: from 93-34-200-238.ip51.fastwebnet.it ([93.34.200.238]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 05 Jan 2012 11:05:19 +0100 Received: from pbonzini by 93-34-200-238.ip51.fastwebnet.it with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 05 Jan 2012 11:05:19 +0100 From: Paolo Bonzini Date: Thu, 05 Jan 2012 11:05:02 +0100 Message-ID: References: <1324651143-5247-1-git-send-email-pbonzini@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit In-Reply-To: <1324651143-5247-1-git-send-email-pbonzini@redhat.com> Subject: Re: [Qemu-devel] [PATCH] virtio-blk: refuse SG_IO requests with scsi=off List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org On 12/23/2011 03:39 PM, Paolo Bonzini wrote: > QEMU does have a "scsi" option (to be used like -device > virtio-blk-pci,drive=foo,scsi=off). However, it only > masks the feature bit, and does not reject the command > if a malicious guest disregards the feature bits and > issues a request. > > Without this patch, using scsi=off does not protect you > from CVE-2011-4127. > > Signed-off-by: Paolo Bonzini > --- > hw/virtio-blk.c | 6 ++++++ > 1 files changed, 6 insertions(+), 0 deletions(-) > > diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c > index b70d116..6cd3164 100644 > --- a/hw/virtio-blk.c > +++ b/hw/virtio-blk.c > @@ -153,6 +153,12 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req) > int status; > int i; > > + if ((req->dev->vdev.guest_features& (1<< VIRTIO_BLK_F_SCSI)) == 0) { > + virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP); > + g_free(req); > + return; > + } > + > /* > * We require at least one output segment each for the virtio_blk_outhdr > * and the SCSI command block. Ping. Paolo