debian/patches/CVE-2016-2538-usb-check-RNDIS-message-length.patch

   1 From 56ed8c01f949f8a0ee45bfe91aed3a973c79a5db Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Wed, 17 Feb 2016 00:23:40 +0530
   4 Subject: [PATCH] usb: check RNDIS message length
   5
   6 When processing remote NDIS control message packets, the USB Net
   7 device emulator uses a fixed length(4096) data buffer. The incoming
   8 packet length could exceed this limit. Add a check to avoid it.
   9
  10 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  11
  12 usb: check RNDIS buffer offsets & length
  13
  14 When processing remote NDIS control message packets,
  15 the USB Net device emulator uses a fixed length(4096) data buffer.
  16 The incoming informationBufferOffset & Length combination could
  17 overflow and cross that range. Check control message buffer
  18 offsets and length to avoid it.
  19
  20 Reported-by: Qinghao Tang <luodalongde@gmail.com>
  21 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  22 ---
  23  hw/usb/core.c        | 18 +++++++++---------
  24  hw/usb/dev-network.c |  9 ++++++---
  25  2 files changed, 15 insertions(+), 12 deletions(-)
  26
  27 diff --git a/hw/usb/core.c b/hw/usb/core.c
  28 index d0025db..7f46370 100644
  29 --- a/hw/usb/core.c
  30 +++ b/hw/usb/core.c
  31 @@ -128,9 +128,16 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
  32      }
  33
  34      usb_packet_copy(p, s->setup_buf, p->iov.size);
  35 +    s->setup_index = 0;
  36      p->actual_length = 0;
  37      s->setup_len   = (s->setup_buf[7] << 8) | s->setup_buf[6];
  38 -    s->setup_index = 0;
  39 +    if (s->setup_len > sizeof(s->data_buf)) {
  40 +        fprintf(stderr,
  41 +                "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
  42 +                s->setup_len, sizeof(s->data_buf));
  43 +        p->status = USB_RET_STALL;
  44 +        return;
  45 +    }
  46
  47      request = (s->setup_buf[0] << 8) | s->setup_buf[1];
  48      value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
  49 @@ -151,13 +158,6 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
  50          }
  51          s->setup_state = SETUP_STATE_DATA;
  52      } else {
  53 -        if (s->setup_len > sizeof(s->data_buf)) {
  54 -            fprintf(stderr,
  55 -                "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
  56 -                s->setup_len, sizeof(s->data_buf));
  57 -            p->status = USB_RET_STALL;
  58 -            return;
  59 -        }
  60          if (s->setup_len == 0)
  61              s->setup_state = SETUP_STATE_ACK;
  62          else
  63 @@ -176,7 +176,7 @@ static void do_token_in(USBDevice *s, USBPacket *p)
  64      request = (s->setup_buf[0] << 8) | s->setup_buf[1];
  65      value   = (s->setup_buf[3] << 8) | s->setup_buf[2];
  66      index   = (s->setup_buf[5] << 8) | s->setup_buf[4];
  67 -
  68 +
  69      switch(s->setup_state) {
  70      case SETUP_STATE_ACK:
  71          if (!(s->setup_buf[0] & USB_DIR_IN)) {
  72 diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
  73 index 8a4ff49..180adce 100644
  74 --- a/hw/usb/dev-network.c
  75 +++ b/hw/usb/dev-network.c
  76 @@ -915,8 +915,9 @@ static int rndis_query_response(USBNetState *s,
  77
  78      bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
  79      buflen = le32_to_cpu(buf->InformationBufferLength);
  80 -    if (bufoffs + buflen > length)
  81 +    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
  82          return USB_RET_STALL;
  83 +    }
  84
  85      infobuflen = ndis_query(s, le32_to_cpu(buf->OID),
  86                              bufoffs + (uint8_t *) buf, buflen, infobuf,
  87 @@ -961,8 +962,9 @@ static int rndis_set_response(USBNetState *s,
  88
  89      bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
  90      buflen = le32_to_cpu(buf->InformationBufferLength);
  91 -    if (bufoffs + buflen > length)
  92 +    if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
  93          return USB_RET_STALL;
  94 +    }
  95
  96      ret = ndis_set(s, le32_to_cpu(buf->OID),
  97                      bufoffs + (uint8_t *) buf, buflen);
  98 @@ -1212,8 +1214,9 @@ static void usb_net_handle_dataout(USBNetState *s, USBPacket *p)
  99      if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) {
 100          uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);
 101          uint32_t size = le32_to_cpu(msg->DataLength);
 102 -        if (offs + size <= len)
 103 +        if (offs < len && size < len && offs + size <= len) {
 104              qemu_send_packet(qemu_get_queue(s->nic), s->out_buf + offs, size);
 105 +        }
 106      }
 107      s->out_ptr -= len;
 108      memmove(s->out_buf, &s->out_buf[len], s->out_ptr);
 109 --
 110 2.1.4
 111