From d2eb2bec876ce962f17e965bfc95315d8380bdcd Mon Sep 17 00:00:00 2001 From: Michael S. Tsirkin Date: Thu, 20 Mar 2014 18:05:22 +0200 Subject: [PATCH 01/48] virtio-net: fix guest-triggerable buffer overrun RH-Author: Michael S. Tsirkin Message-id: <1395331440-2208-1-git-send-email-mst@redhat.com> Patchwork-id: n/a O-Subject: [PATCH qemu-kvm EMBARGOED RHEL6.6/6.5.z] virtio-net: fix guest-triggerable buffer overrun Bugzilla: 1078605 RH-Acked-by: Amos Kong RH-Acked-by: Vlad Yasevich RH-Acked-by: Marcel Apfelbaum When VM guest programs multicast addresses for a virtio net card, it supplies a 32 bit entries counter for the number of addresses. These addresses are read into tail portion of a fixed macs array which has size MAC_TABLE_ENTRIES, at offset equal to in_use. To avoid overflow of this array by guest, qemu attempts to test the size as follows: - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { however, as mac_data.entries is uint32_t, this sum can overflow, e.g. if in_use is 1 and mac_data.entries is 0xffffffff then in_use + mac_data.entries will be 0. Qemu will then read guest supplied buffer into this memory, overflowing buffer on heap. Signed-off-by: Michael S. Tsirkin Upstream status: EMBARGOED Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1078605 Brew build: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7231517 Tested: lightly on developer's box --- hw/virtio-net.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/hw/virtio-net.c b/hw/virtio-net.c index 4f24ef7..2173428 100644 --- a/hw/virtio-net.c +++ b/hw/virtio-net.c @@ -465,7 +465,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd, return VIRTIO_NET_ERR; } - if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { + if (mac_data.entries <= MAC_TABLE_ENTRIES - n->mac_table.in_use) { s = iov_to_buf(iov, iov_cnt, &n->mac_table.macs[n->mac_table.in_use * ETH_ALEN], 0, mac_data.entries * ETH_ALEN); -- 1.7.1