debian/patches/virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch

   1 From edc243851279e3393000b28b6b69454cae1190ef Mon Sep 17 00:00:00 2001
   2 From: "Michael S. Tsirkin" <mst@redhat.com>
   3 Date: Fri, 11 Apr 2014 15:18:08 +0300
   4 Subject: [PATCH] virtio-net: fix guest-triggerable buffer overrun
   5 Bug-Debian: http://bugs.debian.org/744221
   6
   7 When VM guest programs multicast addresses for
   8 a virtio net card, it supplies a 32 bit
   9 entries counter for the number of addresses.
  10 These addresses are read into tail portion of
  11 a fixed macs array which has size MAC_TABLE_ENTRIES,
  12 at offset equal to in_use.
  13
  14 To avoid overflow of this array by guest, qemu attempts
  15 to test the size as follows:
  16 -    if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
  17
  18 however, as mac_data.entries is uint32_t, this sum
  19 can overflow, e.g. if in_use is 1 and mac_data.entries
  20 is 0xffffffff then in_use + mac_data.entries will be 0.
  21
  22 Qemu will then read guest supplied buffer into this
  23 memory, overflowing buffer on heap.
  24
  25 CVE-2014-0150
  26
  27 Cc: qemu-stable@nongnu.org
  28 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  29 Message-id: 1397218574-25058-1-git-send-email-mst@redhat.com
  30 Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
  31 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
  32 Backported-to-1.7: Michael Tokarev <mjt@tls.msk.ru>
  33 ---
  34  hw/net/virtio-net.c |    2 +-
  35  1 file changed, 1 insertion(+), 1 deletion(-)
  36
  37 --- a/hw/net/virtio-net.c
  38 +++ b/hw/net/virtio-net.c
  39 @@ -656,7 +656,7 @@ static int virtio_net_handle_mac(VirtION
  40          goto error;
  41      }
  42
  43 -    if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
  44 +    if (mac_data.entries <= MAC_TABLE_ENTRIES - n->mac_table.in_use) {
  45          s = iov_to_buf(iov, iov_cnt, 0,
  46                         &n->mac_table.macs[n->mac_table.in_use * ETH_ALEN],
  47                         mac_data.entries * ETH_ALEN);