From: Michael S. Tsirkin Date: Wed, 4 Mar 2015 17:12:57 +0000 (+0000) Subject: virtio-net: fix guest-triggerable buffer overrun X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=8c9231f055e1f2a412a6e0aeef72f6b569c82cf8;p=qemu-upstream-4.2-testing.git virtio-net: fix guest-triggerable buffer overrun When VM guest programs multicast addresses for a virtio net card, it supplies a 32 bit entries counter for the number of addresses. These addresses are read into tail portion of a fixed macs array which has size MAC_TABLE_ENTRIES, at offset equal to in_use. To avoid overflow of this array by guest, qemu attempts to test the size as follows: - if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { however, as mac_data.entries is uint32_t, this sum can overflow, e.g. if in_use is 1 and mac_data.entries is 0xffffffff then in_use + mac_data.entries will be 0. Qemu will then read guest supplied buffer into this memory, overflowing buffer on heap. CVE-2014-0150 Cc: qemu-stable@nongnu.org Signed-off-by: Michael S. Tsirkin Message-id: 1397218574-25058-1-git-send-email-mst@redhat.com Reviewed-by: Michael Tokarev Signed-off-by: Peter Maydell Signed-off-by: Stefano Stabellini --- diff --git a/hw/virtio-net.c b/hw/virtio-net.c index 828462fdc..a36f76798 100644 --- a/hw/virtio-net.c +++ b/hw/virtio-net.c @@ -366,7 +366,7 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd, return VIRTIO_NET_ERR; if (mac_data.entries) { - if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) { + if (mac_data.entries <= MAC_TABLE_ENTRIES - n->mac_table.in_use) { memcpy(n->mac_table.macs + (n->mac_table.in_use * ETH_ALEN), elem->out_sg[2].iov_base + sizeof(mac_data), mac_data.entries * ETH_ALEN);