11.04.2014 16:18, Michael S. Tsirkin wrote:
> When VM guest programs multicast addresses for
> a virtio net card, it supplies a 32 bit
> entries counter for the number of addresses.
> These addresses are read into tail portion of
> a fixed macs array which has size MAC_TABLE_ENTRIES,
> at offset equal to in_use.
>
> To avoid overflow of this array by guest, qemu attempts
> to test the size as follows:
> - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
>
> however, as mac_data.entries is uint32_t, this sum
> can overflow, e.g. if in_use is 1 and mac_data.entries
> is 0xffffffff then in_use + mac_data.entries will be 0.
>
> Qemu will then read guest supplied buffer into this
> memory, overflowing buffer on heap.
>
> CVE-2014-0150
>
> Signed-off-by: Michael S. Tsirkin <m...@redhat.com>
Reviewed-by: Michael Tokarev <m...@tls.msk.ru>
> Passed basic tests.
> CVE fix so pick this up for -rc3?
>
> hw/net/virtio-net.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index 439477b..33bd233 100644
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -677,7 +677,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t
> cmd,
> goto error;
> }
>
> - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
> + if (mac_data.entries <= MAC_TABLE_ENTRIES - in_use) {
> s = iov_to_buf(iov, iov_cnt, 0, &macs[in_use * ETH_ALEN],
> mac_data.entries * ETH_ALEN);
> if (s != mac_data.entries * ETH_ALEN) {
>
