Hello community, here is the log from the commit of package kvm for openSUSE:11.3 checked in at Mon Jul 11 16:26:18 CEST 2011. -------- --- old-versions/11.3/UPDATES/all/kvm/kvm.changes 2011-05-20 23:48:36.000000000 +0200 +++ 11.3/kvm/kvm.changes 2011-07-08 18:53:12.000000000 +0200 @@ -1,0 +2,11 @@ +Fri Jul 8 16:32:34 UTC 2011 - brogers@novell.com + +- validate virtqueue indirect descriptor against max size + (bnc#701161) + +------------------------------------------------------------------- +Wed Jul 6 20:45:20 UTC 2011 - brogers@novell.com + +- fix possible out of bounds memory access (bnc#702823) + +------------------------------------------------------------------- calling whatdependson for 11.3-i586 New: ---- kvm-qemu-preXX-validate-virtqueue.patch kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kvm.spec ++++++ --- /var/tmp/diff_new_pack.SDt4HQ/_old 2011-07-11 16:19:35.000000000 +0200 +++ /var/tmp/diff_new_pack.SDt4HQ/_new 2011-07-11 16:19:35.000000000 +0200 @@ -77,7 +77,7 @@ Summary: Kernel-based Virtual Machine Url: http://kvm.qumranet.com/ Version: 0.12.5 -Release: 1.<RELEASE6> +Release: 1.<RELEASE8> Source0: qemu-%{name}-%{version}.tar.bz2 Source1: 60-kvm.rules Source2: qemu-ifup @@ -135,6 +135,8 @@ Patch122: kvm-qemu-preXX-virtio-blk-fail-unaligned-requests.patch Patch123: kvm-qemu-no-hot-unplug-for-certain-devices.patch Patch124: kvm-qemu-preXX-e1000-Pad-short-frames-to-minimum-size-60-.patch +Patch125: kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch +Patch126: kvm-qemu-preXX-validate-virtqueue.patch Patch200: kvm-studio-slirp-nooutgoing.patch Patch201: kvm-studio-vnc.patch @@ -250,6 +252,8 @@ %patch122 -p1 %patch123 -p1 %patch124 -p1 +%patch125 -p1 +%patch126 -p1 # Studio addons %patch200 -p1 ++++++ kvm-qemu-preXX-validate-virtqueue.patch ++++++ EMBARGOED CVE-2011-2212 qemu-kvm: virtqueue: too-large indirect descriptor buffer overflow It was found that virtio subsystem in qemu-kvm did not properly validate virtqueue in and out requests from the guest. A privileged guest user could use this flaw to cause buffer overflow, causing the guest to crash (denial of service) or, possibly, resulting in the privileged guest user escalating their privileges on the host. -- virtqueue_pop (and less importantly, virtqueue_avail_bytes) do not limit the size of an indirect descriptor entry, which allows a guest to specify an arbitrarily-long descriptor chain, which will overflow the fixed-size arrays in VirtQueueElement, leading to memory corruption.
From 8e16077bfcd2d06a98aec8348cc171402ed75b51 Mon Sep 17 00:00:00 2001 From: Nelson Elhage <nelhage@ksplice.com> Date: Thu, 19 May 2011 13:23:17 -0400 Subject: [PATCH] virtqueue: Sanity-check the length of indirect descriptors.
We were previously allowing arbitrarily-long descriptors, which could lead to a buffer overflow in the qemu-kvm process. --- hw/virtio.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) Index: qemu-kvm-0.12.5/hw/virtio.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/virtio.c +++ qemu-kvm-0.12.5/hw/virtio.c @@ -330,6 +330,11 @@ int virtqueue_avail_bytes(VirtQueue *vq, max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc); num_bufs = i = 0; desc_pa = vring_desc_addr(desc_pa, i); + + if (max > VIRTQUEUE_MAX_SIZE) { + fprintf(stderr, "Too-large indirect descriptor"); + exit(1); + } } do { @@ -385,6 +390,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQue max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc); desc_pa = vring_desc_addr(desc_pa, i); i = 0; + + if (max > VIRTQUEUE_MAX_SIZE) { + fprintf(stderr, "Too-large indirect descriptor"); + exit(1); + } } do { ++++++ kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch ++++++
From 7157e2e23e89adcd436caeab31fdd6b47eded377 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Date: Sun, 8 May 2011 22:29:07 +0100 Subject: [PATCH] virtio: guard against negative vq notifies
The virtio_queue_notify() function checks that the virtqueue number is less than the maximum number of virtqueues. A signed comparison is used but the virtqueue number could be negative if a buggy or malicious guest is run. This results in memory accesses outside of the virtqueue array. It is risky doing input validation in common code instead of at the guest<->host boundary. Note that virtio_queue_set_addr(), virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio functions do *not* validate the virtqueue number argument. Instead of fixing the comparison in virtio_queue_notify(), move the comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where we have a uint32_t value and can avoid ever calling into common virtio code if the virtqueue number is invalid. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> --- hw/syborg_virtio.c | 4 +++- hw/virtio-pci.c | 4 +++- hw/virtio.c | 4 +--- 3 files changed, 7 insertions(+), 5 deletions(-) Index: qemu-kvm-0.12.5/hw/syborg_virtio.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/syborg_virtio.c +++ qemu-kvm-0.12.5/hw/syborg_virtio.c @@ -145,7 +145,9 @@ static void syborg_virtio_writel(void *o vdev->queue_sel = value; break; case SYBORG_VIRTIO_QUEUE_NOTIFY: - virtio_queue_notify(vdev, value); + if (value < VIRTIO_PCI_QUEUE_MAX) { + virtio_queue_notify(vdev, value); + } break; case SYBORG_VIRTIO_STATUS: vdev->status = value & 0xFF; Index: qemu-kvm-0.12.5/hw/virtio-pci.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/virtio-pci.c +++ qemu-kvm-0.12.5/hw/virtio-pci.c @@ -197,7 +197,9 @@ static void virtio_ioport_write(void *op vdev->queue_sel = val; break; case VIRTIO_PCI_QUEUE_NOTIFY: - virtio_queue_notify(vdev, val); + if (val < VIRTIO_PCI_QUEUE_MAX) { + virtio_queue_notify(vdev, val); + } break; case VIRTIO_PCI_STATUS: vdev->status = val & 0xFF; Index: qemu-kvm-0.12.5/hw/virtio.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/virtio.c +++ qemu-kvm-0.12.5/hw/virtio.c @@ -568,7 +568,7 @@ int virtio_queue_get_num(VirtIODevice *v void virtio_queue_notify(VirtIODevice *vdev, int n) { - if (n < VIRTIO_PCI_QUEUE_MAX && vdev->vq[n].vring.desc) { + if (vdev->vq[n].vring.desc) { vdev->vq[n].handle_output(vdev, &vdev->vq[n]); } } ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org