diff options
author | Catalin Enache <catalin.enache@windriver.com> | 2017-12-19 12:39:12 +0200 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-01-14 09:11:28 +0000 |
commit | 92a0513837182e2e9aa6c7d4958e495f4b5b4c47 (patch) | |
tree | 7cc710e6bdfd5bb6540120a976803cb4e63e693b /meta/recipes-devtools/qemu | |
parent | 57f0a4ee29b9fc15749a9d42fdf01718a7099c2d (diff) | |
download | openembedded-core-contrib-92a0513837182e2e9aa6c7d4958e495f4b5b4c47.tar.gz |
qemu: CVE-2017-17381
The Virtio Vring implementation in QEMU allows local OS guest users to
cause a denial of service (divide-by-zero error and QEMU process crash)
by unsetting vring alignment while updating Virtio rings.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-17381
Upstream patch:
https://git.qemu.org/?p=qemu.git;a=commitdiff;h=758ead31c7e17bf17a9ef2e0ca1c3e86ab296b43
Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Diffstat (limited to 'meta/recipes-devtools/qemu')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch | 72 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu_2.10.1.bb | 1 |
2 files changed, 73 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch b/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch new file mode 100644 index 0000000000..416771cdcb --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2017-17381.patch @@ -0,0 +1,72 @@ +From 758ead31c7e17bf17a9ef2e0ca1c3e86ab296b43 Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Wed, 29 Nov 2017 23:14:27 +0530 +Subject: [PATCH] virtio: check VirtQueue Vring object is set + +A guest could attempt to use an uninitialised VirtQueue object +or unset Vring.align leading to a arithmetic exception. Add check +to avoid it. + +Upstream-Status: Backport +CVE: CVE-2017-17381 + +Reported-by: Zhangboxian <zhangboxian@huawei.com> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com> +Signed-off-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> +Reviewed-by: Cornelia Huck <cohuck@redhat.com> +Signed-off-by: Catalin Enache <catalin.enache@windriver.com> +--- + hw/virtio/virtio.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c +index 703e672..ad564b0 100644 +--- a/hw/virtio/virtio.c ++++ b/hw/virtio/virtio.c +@@ -182,7 +182,7 @@ void virtio_queue_update_rings(VirtIODevice *vdev, int n) + { + VRing *vring = &vdev->vq[n].vring; + +- if (!vring->desc) { ++ if (!vring->num || !vring->desc || !vring->align) { + /* not yet setup -> nothing to do */ + return; + } +@@ -1414,6 +1414,9 @@ void virtio_config_modern_writel(VirtIODevice *vdev, + + void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr) + { ++ if (!vdev->vq[n].vring.num) { ++ return; ++ } + vdev->vq[n].vring.desc = addr; + virtio_queue_update_rings(vdev, n); + } +@@ -1426,6 +1429,9 @@ hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n) + void virtio_queue_set_rings(VirtIODevice *vdev, int n, hwaddr desc, + hwaddr avail, hwaddr used) + { ++ if (!vdev->vq[n].vring.num) { ++ return; ++ } + vdev->vq[n].vring.desc = desc; + vdev->vq[n].vring.avail = avail; + vdev->vq[n].vring.used = used; +@@ -1494,8 +1500,10 @@ void virtio_queue_set_align(VirtIODevice *vdev, int n, int align) + */ + assert(k->has_variable_vring_alignment); + +- vdev->vq[n].vring.align = align; +- virtio_queue_update_rings(vdev, n); ++ if (align) { ++ vdev->vq[n].vring.align = align; ++ virtio_queue_update_rings(vdev, n); ++ } + } + + static bool virtio_queue_notify_aio_vq(VirtQueue *vq) +-- +2.10.2 + diff --git a/meta/recipes-devtools/qemu/qemu_2.10.1.bb b/meta/recipes-devtools/qemu/qemu_2.10.1.bb index 71cc74ebc7..6c2dd586dd 100644 --- a/meta/recipes-devtools/qemu/qemu_2.10.1.bb +++ b/meta/recipes-devtools/qemu/qemu_2.10.1.bb @@ -34,6 +34,7 @@ SRC_URI = "http://wiki.qemu-project.org/download/${BP}.tar.bz2 \ file://chardev-connect-socket-to-a-spawned-command.patch \ file://apic-fixup-fallthrough-to-PIC.patch \ file://ppc_locking.patch \ + file://CVE-2017-17381.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+\..*)\.tar" |