Accepting request 927617 from home:jziviani:branches:Virtualization

- qemu: virtio-net: heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938 CVE-2021-3748)
  solved by virtio-net-fix-use-after-unmap-free-for-.patch
- kvm,qemu: out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702 CVE-2021-3713)
* Patches added:
  uas-add-stream-number-sanity-checks.patch

OBS-URL: https://build.opensuse.org/request/show/927617
OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=676

bundles.tar.xz

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:898b254c29675506ea3a140a2188cd9036adc5f4d9e9c7997de7852c2408870b
+oid sha256:2db7f326bed24b186a55a6537ed6c7d5d69702aa0e881b1db5bf62faa885279b
-size 58180
+size 53172

qemu.changes

@@ -1,3 +1,14 @@
+-------------------------------------------------------------------
+Tue Oct 26 20:53:59 UTC 2021 - José Ricardo Ziviani <jose.ziviani@suse.com>
+
+- qemu: virtio-net: heap use-after-free in virtio_net_receive_rcu
+  (bsc#1189938 CVE-2021-3748)
+  solved by virtio-net-fix-use-after-unmap-free-for-.patch
+- kvm,qemu: out-of-bounds write in UAS (USB Attached SCSI) device emulation
+  (bsc#1189702 CVE-2021-3713)
+* Patches added:
+  uas-add-stream-number-sanity-checks.patch
+
 -------------------------------------------------------------------
 Fri Oct  8 13:48:40 UTC 2021 - Li Zhang <li.zhang@suse.com>
 

qemu.spec

@@ -1,5 +1,5 @@
 #
-# spec file for package qemu
+# spec file
 #
 # Copyright (c) 2021 SUSE LLC
 #
@@ -195,6 +195,7 @@ Patch00059:     qemu-nbd-Change-default-cache-mode-to-wr.patch
 Patch00060:     virtio-mem-pci-Fix-memory-leak-when-crea.patch
 Patch00061:     vhost-vsock-fix-migration-issue-when-seq.patch
 Patch00062:     block-introduce-max_hw_iov-for-use-in-sc.patch
+Patch00063:     uas-add-stream-number-sanity-checks.patch
 # Patches applied in roms/seabios/:
 Patch01000:     seabios-use-python2-explicitly-as-needed.patch
 Patch01001:     seabios-switch-to-python3-as-needed.patch
@@ -1148,6 +1149,7 @@ This package records qemu testsuite results and represents successful testing.
 %patch00060 -p1
 %patch00061 -p1
 %patch00062 -p1
+%patch00063 -p1
 %patch01000 -p1
 %patch01001 -p1
 %patch01002 -p1

uas-add-stream-number-sanity-checks.patch

@@ -0,0 +1,61 @@
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 18 Aug 2021 14:05:05 +0200
+Subject: uas: add stream number sanity checks.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Git-commit: 13b250b12ad3c59114a6a17d59caf073ce45b33a
+References: bsc#1189702 CVE-2021-3713
+
+The device uses the guest-supplied stream number unchecked, which can
+lead to guest-triggered out-of-band access to the UASDevice->data3 and
+UASDevice->status3 fields.  Add the missing checks.
+
+Fixes: CVE-2021-3713
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reported-by: Chen Zhe <chenzhe@huawei.com>
+Reported-by: Tan Jingguo <tanjingguo@huawei.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-Id: <20210818120505.1258262-2-kraxel@redhat.com>
+Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com>
+---
+ hw/usb/dev-uas.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
+index 263056231c794735c29584e821a8..f6309a5ebfdcc84f81945dd04be0 100644
+--- a/hw/usb/dev-uas.c
++++ b/hw/usb/dev-uas.c
+@@ -840,6 +840,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
+         }
+         break;
+     case UAS_PIPE_ID_STATUS:
++        if (p->stream > UAS_MAX_STREAMS) {
++            goto err_stream;
++        }
+         if (p->stream) {
+             QTAILQ_FOREACH(st, &uas->results, next) {
+                 if (st->stream == p->stream) {
+@@ -867,6 +870,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
+         break;
+     case UAS_PIPE_ID_DATA_IN:
+     case UAS_PIPE_ID_DATA_OUT:
++        if (p->stream > UAS_MAX_STREAMS) {
++            goto err_stream;
++        }
+         if (p->stream) {
+             req = usb_uas_find_request(uas, p->stream);
+         } else {
+@@ -902,6 +908,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
+         p->status = USB_RET_STALL;
+         break;
+     }
++
++err_stream:
++    error_report("%s: invalid stream %d", __func__, p->stream);
++    p->status = USB_RET_STALL;
++    return;
+ }
+ 
+ static void usb_uas_unrealize(USBDevice *dev)

vhost-vsock-fix-migration-issue-when-seq.patch

@@ -56,7 +56,10 @@ index 1b1a5c70eded006acf3cd142b6e6..dade0da03147705ede0180dc3039 100644
  {
      VHostVSockCommon *vvc = VHOST_VSOCK_COMMON(vdev);
 +    VHostVSock *vsock = VHOST_VSOCK(vdev);
-+
+ 
+-    virtio_add_feature(&requested_features, VIRTIO_VSOCK_F_SEQPACKET);
+-    return vhost_get_features(&vvc->vhost_dev, feature_bits,
+-                                requested_features);
 +    if (vsock->seqpacket != ON_OFF_AUTO_OFF) {
 +        virtio_add_feature(&requested_features, VIRTIO_VSOCK_F_SEQPACKET);
 +    }
@@ -68,10 +71,7 @@ index 1b1a5c70eded006acf3cd142b6e6..dade0da03147705ede0180dc3039 100644
 +        !virtio_has_feature(requested_features, VIRTIO_VSOCK_F_SEQPACKET)) {
 +        error_setg(errp, "vhost-vsock backend doesn't support seqpacket");
 +    }
- 
++
--    virtio_add_feature(&requested_features, VIRTIO_VSOCK_F_SEQPACKET);
--    return vhost_get_features(&vvc->vhost_dev, feature_bits,
--                                requested_features);
 +    return requested_features;
  }
  

virtio-net-fix-use-after-unmap-free-for-.patch

@@ -3,6 +3,7 @@ Date: Thu, 2 Sep 2021 13:44:12 +0800
 Subject: virtio-net: fix use after unmap/free for sg
 
 Git-commit: bedd7e93d01961fcb16a97ae45d93acf357e11f6
+References: CVE-2021-3748 1189938
 
 When mergeable buffer is enabled, we try to set the num_buffers after
 the virtqueue elem has been unmapped. This will lead several issues,