[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] afd909: virtio: error out if guest exceeds vi
From: |
GitHub |
Subject: |
[Qemu-commits] [qemu/qemu] afd909: virtio: error out if guest exceeds virtqueue size |
Date: |
Wed, 27 Jul 2016 10:30:04 -0700 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: afd9096eb1882f23929f5b5c177898ed231bac66
https://github.com/qemu/qemu/commit/afd9096eb1882f23929f5b5c177898ed231bac66
Author: Stefan Hajnoczi <address@hidden>
Date: 2016-07-27 (Wed, 27 Jul 2016)
Changed paths:
M hw/virtio/virtio.c
Log Message:
-----------
virtio: error out if guest exceeds virtqueue size
A broken or malicious guest can submit more requests than the virtqueue
size permits, causing unbounded memory allocation in QEMU.
The guest can submit requests without bothering to wait for completion
and is therefore not bound by virtqueue size. This requires reusing
vring descriptors in more than one request, which is not allowed by the
VIRTIO 1.0 specification.
In "3.2.1 Supplying Buffers to The Device", the VIRTIO 1.0 specification
says:
1. The driver places the buffer into free descriptor(s) in the
descriptor table, chaining as necessary
and
Note that the above code does not take precautions against the
available ring buffer wrapping around: this is not possible since the
ring buffer is the same size as the descriptor table, so step (1) will
prevent such a condition.
This implies that placing more buffers into the virtqueue than the
descriptor table size is not allowed.
QEMU is missing the check to prevent this case. Processing a request
allocates a VirtQueueElement leading to unbounded memory allocation
controlled by the guest.
Exit with an error if the guest provides more requests than the
virtqueue size permits. This bounds memory allocation and makes the
buggy guest visible to the user.
This patch fixes CVE-2016-5403 and was reported by Zhenhao Hong from 360
Marvel Team, China.
Reported-by: Zhenhao Hong <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
Commit: 51313fe4f4afea65970a20b32ed2d35b44fbf993
https://github.com/qemu/qemu/commit/51313fe4f4afea65970a20b32ed2d35b44fbf993
Author: Peter Maydell <address@hidden>
Date: 2016-07-27 (Wed, 27 Jul 2016)
Changed paths:
M hw/virtio/virtio.c
Log Message:
-----------
Merge remote-tracking branch
'remotes/stefanha/tags/CVE-2016-5403-virtio-unbounded-allocation-pull-request'
into staging
# gpg: Signature made Wed 27 Jul 2016 16:13:02 BST
# gpg: using RSA key 0x9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <address@hidden>"
# gpg: aka "Stefan Hajnoczi <address@hidden>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35 775A 9CA4 ABB3 81AB 73C8
* remotes/stefanha/tags/CVE-2016-5403-virtio-unbounded-allocation-pull-request:
virtio: error out if guest exceeds virtqueue size
Signed-off-by: Peter Maydell <address@hidden>
Compare: https://github.com/qemu/qemu/compare/df5c50a20829...51313fe4f4af
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] afd909: virtio: error out if guest exceeds virtqueue size,
GitHub <=