[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 12/13] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
From: |
Kevin Wolf |
Subject: |
[PULL 12/13] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) |
Date: |
Mon, 27 Jan 2020 18:55:58 +0100 |
From: Felipe Franciosi <address@hidden>
When querying an iSCSI server for the provisioning status of blocks (via
GET LBA STATUS), Qemu only validates that the response descriptor zero's
LBA matches the one requested. Given the SCSI spec allows servers to
respond with the status of blocks beyond the end of the LUN, Qemu may
have its heap corrupted by clearing/setting too many bits at the end of
its allocmap for the LUN.
A malicious guest in control of the iSCSI server could carefully program
Qemu's heap (by selectively setting the bitmap) and then smash it.
This limits the number of bits that iscsi_co_block_status() will try to
update in the allocmap so it can't overflow the bitmap.
Fixes: CVE-2020-1711
Cc: address@hidden
Signed-off-by: Felipe Franciosi <address@hidden>
Signed-off-by: Peter Turschmid <address@hidden>
Signed-off-by: Raphael Norwitz <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
block/iscsi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/block/iscsi.c b/block/iscsi.c
index 2aea7e3f13..cbd57294ab 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -701,7 +701,7 @@ static int coroutine_fn
iscsi_co_block_status(BlockDriverState *bs,
struct scsi_get_lba_status *lbas = NULL;
struct scsi_lba_status_descriptor *lbasd = NULL;
struct IscsiTask iTask;
- uint64_t lba;
+ uint64_t lba, max_bytes;
int ret;
iscsi_co_init_iscsitask(iscsilun, &iTask);
@@ -721,6 +721,7 @@ static int coroutine_fn
iscsi_co_block_status(BlockDriverState *bs,
}
lba = offset / iscsilun->block_size;
+ max_bytes = (iscsilun->num_blocks - lba) * iscsilun->block_size;
qemu_mutex_lock(&iscsilun->mutex);
retry:
@@ -764,7 +765,7 @@ retry:
goto out_unlock;
}
- *pnum = (int64_t) lbasd->num_blocks * iscsilun->block_size;
+ *pnum = MIN((int64_t) lbasd->num_blocks * iscsilun->block_size, max_bytes);
if (lbasd->provisioning == SCSI_PROVISIONING_TYPE_DEALLOCATED ||
lbasd->provisioning == SCSI_PROVISIONING_TYPE_ANCHORED) {
--
2.20.1
- [PULL 03/13] blockdev: fix coding style issues in drive_backup_prepare, (continued)
- [PULL 03/13] blockdev: fix coding style issues in drive_backup_prepare, Kevin Wolf, 2020/01/27
- [PULL 02/13] iotests: Add more "skip_if_unsupported" statements to the python tests, Kevin Wolf, 2020/01/27
- [PULL 05/13] blockdev: unify qmp_blockdev_backup and blockdev-backup transaction paths, Kevin Wolf, 2020/01/27
- [PULL 04/13] blockdev: unify qmp_drive_backup and drive-backup transaction paths, Kevin Wolf, 2020/01/27
- [PULL 11/13] block/backup: fix memory leak in bdrv_backup_top_append(), Kevin Wolf, 2020/01/27
- [PULL 06/13] blockdev: honor bdrv_try_set_aio_context() context requirements, Kevin Wolf, 2020/01/27
- [PULL 09/13] blockdev: Return bs to the proper context on snapshot abort, Kevin Wolf, 2020/01/27
- [PULL 10/13] iotests: Test handling of AioContexts with some blockdev actions, Kevin Wolf, 2020/01/27
- [PULL 08/13] blockdev: Acquire AioContext on dirty bitmap functions, Kevin Wolf, 2020/01/27
- [PULL 07/13] block/backup-top: Don't acquire context while dropping top, Kevin Wolf, 2020/01/27
- [PULL 12/13] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711),
Kevin Wolf <=
- [PULL 13/13] iscsi: Don't access non-existent scsi_lba_status_descriptor, Kevin Wolf, 2020/01/27
- Re: [PULL 00/13] Block layer patches, Peter Maydell, 2020/01/28