Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=fafb3ff9ab458161dadaa87482dd37697ab9c612
commit fafb3ff9ab458161dadaa87482dd37697ab9c612 Author: kikadf <[email protected]> Date: Wed Dec 10 11:11:46 2014 +0100 qemu-1.5.2-3arcturus8-x86_64 * Fix CVE-2014-7840, CVE-2014-8106 diff --git a/source/xapps-extra/qemu/CVE-2014-7840.patch b/source/xapps-extra/qemu/CVE-2014-7840.patch new file mode 100644 index 0000000..758eabb --- /dev/null +++ b/source/xapps-extra/qemu/CVE-2014-7840.patch @@ -0,0 +1,56 @@ +From: "Michael S. Tsirkin" <[email protected]> +Date: Wed, 12 Nov 2014 11:44:39 +0200 +Subject: [PATCH] migration: fix parameter validation on ram load + +During migration, the values read from migration stream during ram load +are not validated. Especially offset in host_from_stream_offset() and +also the length of the writes in the callers of said function. + +To fix this, we need to make sure that the [offset, offset + length] +range fits into one of the allocated memory regions. + +Validating addr < len should be sufficient since data seems to always be +managed in TARGET_PAGE_SIZE chunks. + +Fixes: CVE-2014-7840 + +Note: follow-up patches add extra checks on each block->host access. + +Signed-off-by: Michael S. Tsirkin <[email protected]> +Reviewed-by: Paolo Bonzini <[email protected]> +Reviewed-by: Dr. David Alan Gilbert <[email protected]> +Signed-off-by: Amit Shah <[email protected]> +(cherry picked from commit 0be839a2701369f669532ea5884c15bead1c6e08) + +Conflicts: + arch_init.c +--- + arch_init.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch_init.c b/arch_init.c +index 23151b3..b6f7958 100644 +--- a/arch_init.c ++++ b/arch_init.c +@@ -816,8 +816,8 @@ static inline void *host_from_stream_offset(QEMUFile *f, + uint8_t len; + + if (flags & RAM_SAVE_FLAG_CONTINUE) { +- if (!block) { +- fprintf(stderr, "Ack, bad migration stream!\n"); ++ if (!block || block->length <= offset) { ++ fprintf(stderr, "Ack, bad migration stream!"); + return NULL; + } + +@@ -829,8 +829,9 @@ static inline void *host_from_stream_offset(QEMUFile *f, + id[len] = 0; + + QTAILQ_FOREACH(block, &ram_list.blocks, next) { +- if (!strncmp(id, block->idstr, sizeof(id))) ++ if (!strncmp(id, block->idstr, sizeof(id)) && block->length > offset) { + return memory_region_get_ram_ptr(block->mr) + offset; ++ } + } + + fprintf(stderr, "Can't find block %s!\n", id); diff --git a/source/xapps-extra/qemu/CVE-2014-8106-1.patch b/source/xapps-extra/qemu/CVE-2014-8106-1.patch new file mode 100644 index 0000000..515d933 --- /dev/null +++ b/source/xapps-extra/qemu/CVE-2014-8106-1.patch @@ -0,0 +1,126 @@ +From d3532a0db02296e687711b8cdc7791924efccea0 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann <[email protected]> +Date: Wed, 19 Nov 2014 11:37:42 +0100 +Subject: cirrus: fix blit region check +Bug-Debian: http://bugs.debian.org/772025 + +Issues: + * Doesn't check pitches correctly in case it is negative. + * Doesn't check width at all. + +Turn macro into functions while being at it, also factor out the check +for one region which we then can simply call twice for src + dst. + +This is CVE-2014-8106. + +Reported-by: Paolo Bonzini <[email protected]> +Signed-off-by: Gerd Hoffmann <[email protected]> +Reviewed-by: Paolo Bonzini <[email protected]> +--- + hw/display/cirrus_vga.c | 61 ++++++++++++++++++++++++++++++++++------------- + 1 file changed, 44 insertions(+), 17 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 8a5b76c..d54fb06 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -173,20 +173,6 @@ + + #define CIRRUS_PNPMMIO_SIZE 0x1000 + +-#define BLTUNSAFE(s) \ +- ( \ +- ( /* check dst is within bounds */ \ +- (s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \ +- + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \ +- (s)->vga.vram_size \ +- ) || \ +- ( /* check src is within bounds */ \ +- (s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \ +- + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \ +- (s)->vga.vram_size \ +- ) \ +- ) +- + struct CirrusVGAState; + typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s, + uint8_t * dst, const uint8_t * src, +@@ -279,6 +265,46 @@ static void cirrus_update_memory_access(CirrusVGAState *s); + * + ***************************************/ + ++static bool blit_region_is_unsafe(struct CirrusVGAState *s, ++ int32_t pitch, int32_t addr) ++{ ++ if (pitch < 0) { ++ int64_t min = addr ++ + ((int64_t)s->cirrus_blt_height-1) * pitch; ++ int32_t max = addr ++ + s->cirrus_blt_width; ++ if (min < 0 || max >= s->vga.vram_size) { ++ return true; ++ } ++ } else { ++ int64_t max = addr ++ + ((int64_t)s->cirrus_blt_height-1) * pitch ++ + s->cirrus_blt_width; ++ if (max >= s->vga.vram_size) { ++ return true; ++ } ++ } ++ return false; ++} ++ ++static bool blit_is_unsafe(struct CirrusVGAState *s) ++{ ++ /* should be the case, see cirrus_bitblt_start */ ++ assert(s->cirrus_blt_width > 0); ++ assert(s->cirrus_blt_height > 0); ++ ++ if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch, ++ s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) { ++ return true; ++ } ++ if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch, ++ s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) { ++ return true; ++ } ++ ++ return false; ++} ++ + static void cirrus_bitblt_rop_nop(CirrusVGAState *s, + uint8_t *dst,const uint8_t *src, + int dstpitch,int srcpitch, +@@ -636,7 +662,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, + + dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask); + +- if (BLTUNSAFE(s)) ++ if (blit_is_unsafe(s)) + return 0; + + (*s->cirrus_rop) (s, dst, src, +@@ -654,8 +680,9 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + { + cirrus_fill_t rop_func; + +- if (BLTUNSAFE(s)) ++ if (blit_is_unsafe(s)) { + return 0; ++ } + rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1]; + rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask), + s->cirrus_blt_dstpitch, +@@ -752,7 +779,7 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + { +- if (BLTUNSAFE(s)) ++ if (blit_is_unsafe(s)) + return 0; + + cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, +-- +1.7.10.4 + diff --git a/source/xapps-extra/qemu/CVE-2014-8106-2.patch b/source/xapps-extra/qemu/CVE-2014-8106-2.patch new file mode 100644 index 0000000..4520715 --- /dev/null +++ b/source/xapps-extra/qemu/CVE-2014-8106-2.patch @@ -0,0 +1,31 @@ +From bf25983345ca44aec3dd92c57142be45452bd38a Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann <[email protected]> +Date: Wed, 19 Nov 2014 13:27:28 +0100 +Subject: cirrus: don't overflow CirrusVGAState->cirrus_bltbuf +Bug-Debian: http://bugs.debian.org/772025 + +This is CVE-2014-8106. + +Signed-off-by: Gerd Hoffmann <[email protected]> +--- + hw/display/cirrus_vga.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index d54fb06..2725264 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -293,6 +293,10 @@ static bool blit_is_unsafe(struct CirrusVGAState *s) + assert(s->cirrus_blt_width > 0); + assert(s->cirrus_blt_height > 0); + ++ if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) { ++ return true; ++ } ++ + if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch, + s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) { + return true; +-- +1.7.10.4 + diff --git a/source/xapps-extra/qemu/FrugalBuild b/source/xapps-extra/qemu/FrugalBuild index 7d52868..717fb01 100644 --- a/source/xapps-extra/qemu/FrugalBuild +++ b/source/xapps-extra/qemu/FrugalBuild @@ -9,7 +9,7 @@ USE_DEVEL=${USE_DEVEL:-"n"} pkgname=qemu pkgver=1.5.2 Fuse $USE_DEVEL && pkgver=svn6369 -pkgrel=3arcturus7 +pkgrel=3arcturus8 Fuse $USE_DEVEL && pkgrel=1 pkgdesc="QEMU is a FAST! processor emulator" url="http://www.nongnu.org/qemu/"; @@ -51,7 +51,8 @@ TARGETS="i386-softmmu x86_64-softmmu arm-softmmu" source=(${source[@]} CVE-2013-4344.patch CVE-2013-4375.patch CVE-2013-4377.patch CVE-2014-0150.patch CVE-2013-4544.patch CVE-2014-2894.patch CVE-2014-3640.patch CVE-2014-3615.patch CVE-2014-3689.patch - CVE-2014-7815.patch) + CVE-2014-7815.patch CVE-2014-8106-1.patch CVE-2014-8106-2.patch + CVE-2014-7840.patch) sha1sums=(${sha1sums[@]} '24acdb676d4bea695e7b0a2cb75efdebca92bb0f' \ '761b353dbbd110fd8e75e0e5f471effdc8e37beb' \ 'b50f8d0fcb307220ec670685835808dbd387fc7e' \ @@ -61,11 +62,13 @@ sha1sums=(${sha1sums[@]} '24acdb676d4bea695e7b0a2cb75efdebca92bb0f' \ '47a312a667488b3be2c94ea2c7bb5bdcb923f247' \ '3fe6dce9a5daac9088fdfdea86cfae3ab5c05f81' \ '1beb3322a61033344c0f6a80019160c26052872a' \ - 'dc3bf6ed322dfd24e4e7fc5031b2d19f27112ce4') + 'dc3bf6ed322dfd24e4e7fc5031b2d19f27112ce4' \ + 'ef90523bbee7e5dc60ff03ab0cedcb5b972089ff' \ + '9b974cfac92f7977c1b0263a8dfc7c41a57c308f' \ + '59ba5cd08956e31cf08001495da829861c2d37a2') # *********** - build() { if Fuse $USE_DEVEL; then _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
