From 92a0513837182e2e9aa6c7d4958e495f4b5b4c47 Mon Sep 17 00:00:00 2001 From: Catalin Enache Date: Tue, 19 Dec 2017 12:39:12 +0200 Subject: qemu: CVE-2017-17381 The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-17381 Upstream patch: https://git.qemu.org/?p=qemu.git;a=commitdiff;h=758ead31c7e17bf17a9ef2e0ca1c3e86ab296b43 Signed-off-by: Catalin Enache Signed-off-by: Ross Burton --- .../qemu/qemu/CVE-2017-17381.patch | 72 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_2.10.1.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch b/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch new file mode 100644 index 0000000000..416771cdcb --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch @@ -0,0 +1,72 @@ +From 758ead31c7e17bf17a9ef2e0ca1c3e86ab296b43 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Wed, 29 Nov 2017 23:14:27 +0530 +Subject: [PATCH] virtio: check VirtQueue Vring object is set + +A guest could attempt to use an uninitialised VirtQueue object +or unset Vring.align leading to a arithmetic exception. Add check +to avoid it. + +Upstream-Status: Backport +CVE: CVE-2017-17381 + +Reported-by: Zhangboxian +Signed-off-by: Prasad J Pandit +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Stefan Hajnoczi +Reviewed-by: Cornelia Huck +Signed-off-by: Catalin Enache +--- + hw/virtio/virtio.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 703e672..ad564b0 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -182,7 +182,7 @@ void virtio_queue_update_rings(VirtIODevice *vdev, int n) + { + VRing *vring = &vdev->vq[n].vring; + +- if (!vring->desc) { ++ if (!vring->num || !vring->desc || !vring->align) { + /* not yet setup -> nothing to do */ + return; + } +@@ -1414,6 +1414,9 @@ void virtio_config_modern_writel(VirtIODevice *vdev, + + void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr) + { ++ if (!vdev->vq[n].vring.num) { ++ return; ++ } + vdev->vq[n].vring.desc = addr; + virtio_queue_update_rings(vdev, n); + } +@@ -1426,6 +1429,9 @@ hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n) + void virtio_queue_set_rings(VirtIODevice *vdev, int n, hwaddr desc, + hwaddr avail, hwaddr used) + { ++ if (!vdev->vq[n].vring.num) { ++ return; ++ } + vdev->vq[n].vring.desc = desc; + vdev->vq[n].vring.avail = avail; + vdev->vq[n].vring.used = used; +@@ -1494,8 +1500,10 @@ void virtio_queue_set_align(VirtIODevice *vdev, int n, int align) + */ + assert(k->has_variable_vring_alignment); + +- vdev->vq[n].vring.align = align; +- virtio_queue_update_rings(vdev, n); ++ if (align) { ++ vdev->vq[n].vring.align = align; ++ virtio_queue_update_rings(vdev, n); ++ } + } + + static bool virtio_queue_notify_aio_vq(VirtQueue *vq) +-- +2.10.2 + diff --git a/meta/recipes-devtools/qemu/qemu_2.10.1.bb b/meta/recipes-devtools/qemu/qemu_2.10.1.bb index 71cc74ebc7..6c2dd586dd 100644 --- a/meta/recipes-devtools/qemu/qemu_2.10.1.bb +++ b/meta/recipes-devtools/qemu/qemu_2.10.1.bb @@ -34,6 +34,7 @@ SRC_URI = "http://wiki.qemu-project.org/download/${BP}.tar.bz2 \ file://chardev-connect-socket-to-a-spawned-command.patch \ file://apic-fixup-fallthrough-to-PIC.patch \ file://ppc_locking.patch \ + file://CVE-2017-17381.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P\d+\..*)\.tar" -- cgit 1.2.3-korg