Hello community, here is the log from the commit of package kvm for openSUSE:Factory checked in at Thu Jul 7 15:00:49 CEST 2011.
-------- --- kvm/kvm.changes 2011-06-07 17:21:43.000000000 +0200 +++ /mounts/work_src_done/STABLE/kvm/kvm.changes 2011-07-06 21:22:00.000000000 +0200 @@ -1,0 +2,5 @@ +Wed Jul 6 19:14:24 UTC 2011 - [email protected] + +- fix possible out of bounds memory access (bnc#702823) + +------------------------------------------------------------------- calling whatdependson for head-i586 New: ---- kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kvm.spec ++++++ --- /var/tmp/diff_new_pack.jVuz1T/_old 2011-07-07 14:57:55.000000000 +0200 +++ /var/tmp/diff_new_pack.jVuz1T/_new 2011-07-07 14:57:55.000000000 +0200 @@ -89,7 +89,7 @@ Summary: Kernel-based Virtual Machine Url: http://kvm.qumranet.com/ Version: %{package_base_version}%{package_extra_version} -Release: 5 +Release: 7 Source0: qemu-%{name}-%{package_base_version}.tar.bz2 Source1: 60-kvm.rules Source2: qemu-ifup @@ -180,6 +180,7 @@ Patch133: kvm-qemu-preXX-vnc-fix-build-error-from-VNC_DIRTY_WORDS.patch Patch134: kvm-qemu-preXX-severe-memory-leak-caused-by-broken-palett.patch Patch135: kvm-qemu-no-hot-unplug-for-certain-devices.patch +Patch136: kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch Patch200: qemu-img-vmdk-scsi.patch Patch201: kvm-studio-slirp-nooutgoing.patch @@ -335,6 +336,7 @@ %patch133 -p1 %patch134 -p1 %patch135 -p1 +%patch136 -p1 # Studio addons %patch200 -p1 ++++++ kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch ++++++ >From 7157e2e23e89adcd436caeab31fdd6b47eded377 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi <[email protected]> Date: Sun, 8 May 2011 22:29:07 +0100 Subject: [PATCH] virtio: guard against negative vq notifies The virtio_queue_notify() function checks that the virtqueue number is less than the maximum number of virtqueues. A signed comparison is used but the virtqueue number could be negative if a buggy or malicious guest is run. This results in memory accesses outside of the virtqueue array. It is risky doing input validation in common code instead of at the guest<->host boundary. Note that virtio_queue_set_addr(), virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio functions do *not* validate the virtqueue number argument. Instead of fixing the comparison in virtio_queue_notify(), move the comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where we have a uint32_t value and can avoid ever calling into common virtio code if the virtqueue number is invalid. Signed-off-by: Stefan Hajnoczi <[email protected]> Signed-off-by: Michael S. Tsirkin <[email protected]> --- hw/syborg_virtio.c | 4 +++- hw/virtio-pci.c | 4 +++- hw/virtio.c | 4 +--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/hw/syborg_virtio.c b/hw/syborg_virtio.c index 2f3e6da..00c7be8 100644 --- a/hw/syborg_virtio.c +++ b/hw/syborg_virtio.c @@ -146,7 +146,9 @@ static void syborg_virtio_writel(void *opaque, target_phys_addr_t offset, vdev->queue_sel = value; break; case SYBORG_VIRTIO_QUEUE_NOTIFY: - virtio_queue_notify(vdev, value); + if (value < VIRTIO_PCI_QUEUE_MAX) { + virtio_queue_notify(vdev, value); + } break; case SYBORG_VIRTIO_STATUS: virtio_set_status(vdev, value & 0xFF); diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c index 270e2c7..b86c441 100644 --- a/hw/virtio-pci.c +++ b/hw/virtio-pci.c @@ -348,7 +348,9 @@ static void virtio_ioport_write(void *opaque, uint32_t addr, uint32_t val) vdev->queue_sel = val; break; case VIRTIO_PCI_QUEUE_NOTIFY: - virtio_queue_notify(vdev, val); + if (val < VIRTIO_PCI_QUEUE_MAX) { + virtio_queue_notify(vdev, val); + } break; case VIRTIO_PCI_STATUS: if (!(val & VIRTIO_CONFIG_S_DRIVER_OK)) { diff --git a/hw/virtio.c b/hw/virtio.c index 6e8814c..a651860 100644 --- a/hw/virtio.c +++ b/hw/virtio.c @@ -585,9 +585,7 @@ void virtio_queue_notify_vq(VirtQueue *vq) void virtio_queue_notify(VirtIODevice *vdev, int n) { - if (n < VIRTIO_PCI_QUEUE_MAX) { - virtio_queue_notify_vq(&vdev->vq[n]); - } + virtio_queue_notify_vq(&vdev->vq[n]); } uint16_t virtio_queue_vector(VirtIODevice *vdev, int n) -- 1.6.0.2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
