7325eaecfb
- Include upstream patches targeted for the next stable release (bug fixes only) spapr-Fix-failure-path-for-attempting-to.patch target-i386-do-not-set-unsupported-VMX-s.patch target-xtensa-fix-pasto-in-pfwait.r-opco.patch tcg-i386-Fix-INDEX_op_dup2_vec.patch tcg-mips-mips-sync-encode-error.patch vhost-user-gpu-Release-memory-returned-b.patch vpc-Don-t-round-up-already-aligned-BAT-s.patch xen-block-Fix-double-qlist-remove-and-re.patch - Fix bug causing weak encryption in PAuth for ARM (CVE-2020-10702 bsc#1168681) target-arm-Fix-PAuth-sbox-functions.patch - Fix OOB in tulip NIC emulation (CVE-2020-11102 bsc#1168713 net-tulip-check-frame-size-and-r-w-data-.patch - Note that previously included patch addresses CVE-2020-1711 and bsc#1166240 iscsi-Cap-block-count-from-GET-LBA-STATU.patch - Include performance improvement (and related?) patch aio-wait-delegate-polling-of-main-AioCon.patch async-use-explicit-memory-barriers.patch - Rework previous patch at Olaf H.'s direction hw-i386-disable-smbus-migration-for-xenf.patch - Eliminate is_opensuse usage in producing seabios version string what we are doing here is just replacing the upstream string with one indicating that the openSUSE build service built it, and so just leave it as "-rebuilt.opensuse.org" - Alter algorithm used to produce "unique" symbol for coordinating qemu with the optional modules it may load. This is a reasonable relaxation for broader compatibility configure-remove-pkgversion-from-CONFIG_.patch - Tweak supported.*.txt for latest deprecations, and other fixes - Tweak update_git.sh, config.sh - One more fix is needed for: s390x Protected Virtualization support - start and control guest in secure mode (bsc#1167075 jsc#SLE-7407) s390x-s390-virtio-ccw-Fix-build-on-syste.patch OBS-URL: https://build.opensuse.org/request/show/795118 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=542
62 lines
2.3 KiB
Diff
62 lines
2.3 KiB
Diff
From: Felipe Franciosi <felipe@nutanix.com>
|
|
Date: Thu, 23 Jan 2020 12:44:59 +0000
|
|
Subject: iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
|
|
|
|
Git-commit: 693fd2acdf14dd86c0bf852610f1c2cca80a74dc
|
|
References: bsc#1166240, CVE-2020-1711
|
|
|
|
When querying an iSCSI server for the provisioning status of blocks (via
|
|
GET LBA STATUS), Qemu only validates that the response descriptor zero's
|
|
LBA matches the one requested. Given the SCSI spec allows servers to
|
|
respond with the status of blocks beyond the end of the LUN, Qemu may
|
|
have its heap corrupted by clearing/setting too many bits at the end of
|
|
its allocmap for the LUN.
|
|
|
|
A malicious guest in control of the iSCSI server could carefully program
|
|
Qemu's heap (by selectively setting the bitmap) and then smash it.
|
|
|
|
This limits the number of bits that iscsi_co_block_status() will try to
|
|
update in the allocmap so it can't overflow the bitmap.
|
|
|
|
Fixes: CVE-2020-1711
|
|
Cc: qemu-stable@nongnu.org
|
|
Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
|
|
Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com>
|
|
Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
block/iscsi.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/block/iscsi.c b/block/iscsi.c
|
|
index 2aea7e3f13f73662a838d2f8187f..cbd57294ab4417a33657af0fbce8 100644
|
|
--- a/block/iscsi.c
|
|
+++ b/block/iscsi.c
|
|
@@ -701,7 +701,7 @@ static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
|
|
struct scsi_get_lba_status *lbas = NULL;
|
|
struct scsi_lba_status_descriptor *lbasd = NULL;
|
|
struct IscsiTask iTask;
|
|
- uint64_t lba;
|
|
+ uint64_t lba, max_bytes;
|
|
int ret;
|
|
|
|
iscsi_co_init_iscsitask(iscsilun, &iTask);
|
|
@@ -721,6 +721,7 @@ static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
|
|
}
|
|
|
|
lba = offset / iscsilun->block_size;
|
|
+ max_bytes = (iscsilun->num_blocks - lba) * iscsilun->block_size;
|
|
|
|
qemu_mutex_lock(&iscsilun->mutex);
|
|
retry:
|
|
@@ -764,7 +765,7 @@ retry:
|
|
goto out_unlock;
|
|
}
|
|
|
|
- *pnum = (int64_t) lbasd->num_blocks * iscsilun->block_size;
|
|
+ *pnum = MIN((int64_t) lbasd->num_blocks * iscsilun->block_size, max_bytes);
|
|
|
|
if (lbasd->provisioning == SCSI_PROVISIONING_TYPE_DEALLOCATED ||
|
|
lbasd->provisioning == SCSI_PROVISIONING_TYPE_ANCHORED) {
|