diff --git a/bundles.tar.xz b/bundles.tar.xz index f4d06aaa..85c9b3b2 100644 --- a/bundles.tar.xz +++ b/bundles.tar.xz @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:898b254c29675506ea3a140a2188cd9036adc5f4d9e9c7997de7852c2408870b -size 58180 +oid sha256:2db7f326bed24b186a55a6537ed6c7d5d69702aa0e881b1db5bf62faa885279b +size 53172 diff --git a/qemu.changes b/qemu.changes index 7631a8a2..b1f80052 100644 --- a/qemu.changes +++ b/qemu.changes @@ -1,3 +1,14 @@ +------------------------------------------------------------------- +Tue Oct 26 20:53:59 UTC 2021 - José Ricardo Ziviani + +- qemu: virtio-net: heap use-after-free in virtio_net_receive_rcu + (bsc#1189938 CVE-2021-3748) + solved by virtio-net-fix-use-after-unmap-free-for-.patch +- kvm,qemu: out-of-bounds write in UAS (USB Attached SCSI) device emulation + (bsc#1189702 CVE-2021-3713) +* Patches added: + uas-add-stream-number-sanity-checks.patch + ------------------------------------------------------------------- Fri Oct 8 13:48:40 UTC 2021 - Li Zhang diff --git a/qemu.spec b/qemu.spec index 6a5b667f..729b4391 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,5 +1,5 @@ # -# spec file for package qemu +# spec file # # Copyright (c) 2021 SUSE LLC # @@ -195,6 +195,7 @@ Patch00059: qemu-nbd-Change-default-cache-mode-to-wr.patch Patch00060: virtio-mem-pci-Fix-memory-leak-when-crea.patch Patch00061: vhost-vsock-fix-migration-issue-when-seq.patch Patch00062: block-introduce-max_hw_iov-for-use-in-sc.patch +Patch00063: uas-add-stream-number-sanity-checks.patch # Patches applied in roms/seabios/: Patch01000: seabios-use-python2-explicitly-as-needed.patch Patch01001: seabios-switch-to-python3-as-needed.patch @@ -1148,6 +1149,7 @@ This package records qemu testsuite results and represents successful testing. %patch00060 -p1 %patch00061 -p1 %patch00062 -p1 +%patch00063 -p1 %patch01000 -p1 %patch01001 -p1 %patch01002 -p1 diff --git a/uas-add-stream-number-sanity-checks.patch b/uas-add-stream-number-sanity-checks.patch new file mode 100644 index 00000000..3493df57 --- /dev/null +++ b/uas-add-stream-number-sanity-checks.patch @@ -0,0 +1,61 @@ +From: Gerd Hoffmann +Date: Wed, 18 Aug 2021 14:05:05 +0200 +Subject: uas: add stream number sanity checks. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Git-commit: 13b250b12ad3c59114a6a17d59caf073ce45b33a +References: bsc#1189702 CVE-2021-3713 + +The device uses the guest-supplied stream number unchecked, which can +lead to guest-triggered out-of-band access to the UASDevice->data3 and +UASDevice->status3 fields. Add the missing checks. + +Fixes: CVE-2021-3713 +Signed-off-by: Gerd Hoffmann +Reported-by: Chen Zhe +Reported-by: Tan Jingguo +Reviewed-by: Philippe Mathieu-Daudé +Message-Id: <20210818120505.1258262-2-kraxel@redhat.com> +Signed-off-by: Jose R Ziviani +--- + hw/usb/dev-uas.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c +index 263056231c794735c29584e821a8..f6309a5ebfdcc84f81945dd04be0 100644 +--- a/hw/usb/dev-uas.c ++++ b/hw/usb/dev-uas.c +@@ -840,6 +840,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) + } + break; + case UAS_PIPE_ID_STATUS: ++ if (p->stream > UAS_MAX_STREAMS) { ++ goto err_stream; ++ } + if (p->stream) { + QTAILQ_FOREACH(st, &uas->results, next) { + if (st->stream == p->stream) { +@@ -867,6 +870,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) + break; + case UAS_PIPE_ID_DATA_IN: + case UAS_PIPE_ID_DATA_OUT: ++ if (p->stream > UAS_MAX_STREAMS) { ++ goto err_stream; ++ } + if (p->stream) { + req = usb_uas_find_request(uas, p->stream); + } else { +@@ -902,6 +908,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) + p->status = USB_RET_STALL; + break; + } ++ ++err_stream: ++ error_report("%s: invalid stream %d", __func__, p->stream); ++ p->status = USB_RET_STALL; ++ return; + } + + static void usb_uas_unrealize(USBDevice *dev) diff --git a/vhost-vsock-fix-migration-issue-when-seq.patch b/vhost-vsock-fix-migration-issue-when-seq.patch index 9a3320ff..feac2d92 100644 --- a/vhost-vsock-fix-migration-issue-when-seq.patch +++ b/vhost-vsock-fix-migration-issue-when-seq.patch @@ -56,7 +56,10 @@ index 1b1a5c70eded006acf3cd142b6e6..dade0da03147705ede0180dc3039 100644 { VHostVSockCommon *vvc = VHOST_VSOCK_COMMON(vdev); + VHostVSock *vsock = VHOST_VSOCK(vdev); -+ + +- virtio_add_feature(&requested_features, VIRTIO_VSOCK_F_SEQPACKET); +- return vhost_get_features(&vvc->vhost_dev, feature_bits, +- requested_features); + if (vsock->seqpacket != ON_OFF_AUTO_OFF) { + virtio_add_feature(&requested_features, VIRTIO_VSOCK_F_SEQPACKET); + } @@ -68,10 +71,7 @@ index 1b1a5c70eded006acf3cd142b6e6..dade0da03147705ede0180dc3039 100644 + !virtio_has_feature(requested_features, VIRTIO_VSOCK_F_SEQPACKET)) { + error_setg(errp, "vhost-vsock backend doesn't support seqpacket"); + } - -- virtio_add_feature(&requested_features, VIRTIO_VSOCK_F_SEQPACKET); -- return vhost_get_features(&vvc->vhost_dev, feature_bits, -- requested_features); ++ + return requested_features; } diff --git a/virtio-net-fix-use-after-unmap-free-for-.patch b/virtio-net-fix-use-after-unmap-free-for-.patch index ce8fb00e..728c9c6b 100644 --- a/virtio-net-fix-use-after-unmap-free-for-.patch +++ b/virtio-net-fix-use-after-unmap-free-for-.patch @@ -3,6 +3,7 @@ Date: Thu, 2 Sep 2021 13:44:12 +0800 Subject: virtio-net: fix use after unmap/free for sg Git-commit: bedd7e93d01961fcb16a97ae45d93acf357e11f6 +References: CVE-2021-3748 1189938 When mergeable buffer is enabled, we try to set the num_buffers after the virtqueue elem has been unmapped. This will lead several issues,