From 51cf44903dfa93bc13001854e054db7e145b5677 Mon Sep 17 00:00:00 2001 From: Dietmar Maurer Date: Tue, 22 Apr 2014 06:45:12 +0200 Subject: [PATCH] add virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch --- debian/patches/series | 1 + ...gerable-buffer-overrun-CVE-2014-0150.patch | 47 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 debian/patches/virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch diff --git a/debian/patches/series b/debian/patches/series index a7609e9..cffc9f6 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,4 @@ +virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch fr-ca-keymap-corrections.diff adjust-path.diff fairsched.diff diff --git a/debian/patches/virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch b/debian/patches/virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch new file mode 100644 index 0000000..c280a3f --- /dev/null +++ b/debian/patches/virtio-net-fix-guest-triggerable-buffer-overrun-CVE-2014-0150.patch @@ -0,0 +1,47 @@ +From edc243851279e3393000b28b6b69454cae1190ef Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Fri, 11 Apr 2014 15:18:08 +0300 +Subject: [PATCH] virtio-net: fix guest-triggerable buffer overrun +Bug-Debian: http://bugs.debian.org/744221 + +When VM guest programs multicast addresses for +a virtio net card, it supplies a 32 bit +entries counter for the number of addresses. +These addresses are read into tail portion of +a fixed macs array which has size MAC_TABLE_ENTRIES, +at offset equal to in_use. + +To avoid overflow of this array by guest, qemu attempts +to test the size as follows: +- if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { + +however, as mac_data.entries is uint32_t, this sum +can overflow, e.g. if in_use is 1 and mac_data.entries +is 0xffffffff then in_use + mac_data.entries will be 0. + +Qemu will then read guest supplied buffer into this +memory, overflowing buffer on heap. + +CVE-2014-0150 + +Cc: qemu-stable@nongnu.org +Signed-off-by: Michael S. Tsirkin +Message-id: 1397218574-25058-1-git-send-email-mst@redhat.com +Reviewed-by: Michael Tokarev +Signed-off-by: Peter Maydell +Backported-to-1.7: Michael Tokarev +--- + hw/net/virtio-net.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/hw/net/virtio-net.c ++++ b/hw/net/virtio-net.c +@@ -656,7 +656,7 @@ static int virtio_net_handle_mac(VirtION + goto error; + } + +- if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { ++ if (mac_data.entries <= MAC_TABLE_ENTRIES - n->mac_table.in_use) { + s = iov_to_buf(iov, iov_cnt, 0, + &n->mac_table.macs[n->mac_table.in_use * ETH_ALEN], + mac_data.entries * ETH_ALEN); -- 2.39.2