2746ce73b5
- Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577) e1000-fail-early-for-evil-descriptor.patch - Fix incorrect guest data in s390x PCI passthrough (bsc#1183372) s390x-pci-restore-missing-Query-PCI-Func.patch - Include upstream patches designated as stable material and reviewed for applicability to include here lsilogic-Use-PCIDevice-exit-instead-of-D.patch vhost-user-blk-fix-blkcfg-num_queues-end.patch - Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137) 9pfs-Fully-restart-unreclaim-loop-CVE-20.patch - Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639) net-vmxnet3-validate-configuration-value.patch OBS-URL: https://build.opensuse.org/request/show/879536 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=629
75 lines
3.5 KiB
Diff
75 lines
3.5 KiB
Diff
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Sat, 30 Jan 2021 18:46:52 +0530
|
|
Subject: net: vmxnet3: validate configuration values during activate
|
|
(CVE-2021-20203)
|
|
|
|
Git-commit: 0000000000000000000000000000000000000000
|
|
References: bsc#1181639
|
|
|
|
While activating device in vmxnet3_acticate_device(), it does not
|
|
validate guest supplied configuration values against predefined
|
|
minimum - maximum limits. This may lead to integer overflow or
|
|
OOB access issues. Add checks to avoid it.
|
|
|
|
Fixes: CVE-2021-20203
|
|
Buglink: https://bugs.launchpad.net/qemu/+bug/1913873
|
|
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/net/vmxnet3.c | 13 +++++++++++++
|
|
1 file changed, 13 insertions(+)
|
|
|
|
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
|
|
index eff299f6290cee3e784d93561798..4a910ca97188df056219062c30da 100644
|
|
--- a/hw/net/vmxnet3.c
|
|
+++ b/hw/net/vmxnet3.c
|
|
@@ -1420,6 +1420,7 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
vmxnet3_setup_rx_filtering(s);
|
|
/* Cache fields from shared memory */
|
|
s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
|
|
+ assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);
|
|
VMW_CFPRN("MTU is %u", s->mtu);
|
|
|
|
s->max_rx_frags =
|
|
@@ -1473,6 +1474,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
/* Read rings memory locations for TX queues */
|
|
pa = VMXNET3_READ_TX_QUEUE_DESCR64(d, qdescr_pa, conf.txRingBasePA);
|
|
size = VMXNET3_READ_TX_QUEUE_DESCR32(d, qdescr_pa, conf.txRingSize);
|
|
+ if (size > VMXNET3_TX_RING_MAX_SIZE) {
|
|
+ size = VMXNET3_TX_RING_MAX_SIZE;
|
|
+ }
|
|
|
|
vmxnet3_ring_init(d, &s->txq_descr[i].tx_ring, pa, size,
|
|
sizeof(struct Vmxnet3_TxDesc), false);
|
|
@@ -1483,6 +1487,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
/* TXC ring */
|
|
pa = VMXNET3_READ_TX_QUEUE_DESCR64(d, qdescr_pa, conf.compRingBasePA);
|
|
size = VMXNET3_READ_TX_QUEUE_DESCR32(d, qdescr_pa, conf.compRingSize);
|
|
+ if (size > VMXNET3_TC_RING_MAX_SIZE) {
|
|
+ size = VMXNET3_TC_RING_MAX_SIZE;
|
|
+ }
|
|
vmxnet3_ring_init(d, &s->txq_descr[i].comp_ring, pa, size,
|
|
sizeof(struct Vmxnet3_TxCompDesc), true);
|
|
VMXNET3_RING_DUMP(VMW_CFPRN, "TXC", i, &s->txq_descr[i].comp_ring);
|
|
@@ -1524,6 +1531,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
/* RX rings */
|
|
pa = VMXNET3_READ_RX_QUEUE_DESCR64(d, qd_pa, conf.rxRingBasePA[j]);
|
|
size = VMXNET3_READ_RX_QUEUE_DESCR32(d, qd_pa, conf.rxRingSize[j]);
|
|
+ if (size > VMXNET3_RX_RING_MAX_SIZE) {
|
|
+ size = VMXNET3_RX_RING_MAX_SIZE;
|
|
+ }
|
|
vmxnet3_ring_init(d, &s->rxq_descr[i].rx_ring[j], pa, size,
|
|
sizeof(struct Vmxnet3_RxDesc), false);
|
|
VMW_CFPRN("RX queue %d:%d: Base: %" PRIx64 ", Size: %d",
|
|
@@ -1533,6 +1543,9 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
/* RXC ring */
|
|
pa = VMXNET3_READ_RX_QUEUE_DESCR64(d, qd_pa, conf.compRingBasePA);
|
|
size = VMXNET3_READ_RX_QUEUE_DESCR32(d, qd_pa, conf.compRingSize);
|
|
+ if (size > VMXNET3_RC_RING_MAX_SIZE) {
|
|
+ size = VMXNET3_RC_RING_MAX_SIZE;
|
|
+ }
|
|
vmxnet3_ring_init(d, &s->rxq_descr[i].comp_ring, pa, size,
|
|
sizeof(struct Vmxnet3_RxCompDesc), true);
|
|
VMW_CFPRN("RXC queue %d: Base: %" PRIx64 ", Size: %d", i, pa, size);
|