Add a fix queued upstream for the issue in this CVE: """ Guest driver might execute HW commands when shared buffers are not yet allocated. This might happen on purpose (malicious guest) or because some other guest/host address mapping. We need to protect againts such case. """
Signed-off-by: Richard Purdie <[email protected]> --- meta/recipes-devtools/qemu/qemu.inc | 1 + meta/recipes-devtools/qemu/qemu/pvrdma.patch | 45 ++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/pvrdma.patch diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 9f2fa4322e9..4e94c4b2bf4 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc @@ -32,6 +32,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://0001-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ file://0001-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch \ file://0002-virtio-net-fix-map-leaking-on-error-during-receive.patch \ + file://pvrdma.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" diff --git a/meta/recipes-devtools/qemu/qemu/pvrdma.patch b/meta/recipes-devtools/qemu/qemu/pvrdma.patch new file mode 100644 index 00000000000..7b0335b1dc9 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/pvrdma.patch @@ -0,0 +1,45 @@ +hw/pvrdma: Protect against buggy or malicious guest driver + +Guest driver might execute HW commands when shared buffers are not yet +allocated. +This might happen on purpose (malicious guest) or because some other +guest/host address mapping. +We need to protect againts such case. + +Reported-by: Mauro Matteo Cascella <[email protected]> +Signed-off-by: Yuval Shaia <[email protected]> + +CVE: CVE-2022-1050 +Upstream-Status: Submitted [https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg05197.html] + +Index: qemu-6.2.0/hw/rdma/vmw/pvrdma_cmd.c +=================================================================== +--- qemu-6.2.0.orig/hw/rdma/vmw/pvrdma_cmd.c ++++ qemu-6.2.0/hw/rdma/vmw/pvrdma_cmd.c +@@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev) + + dsr_info = &dev->dsr_info; + ++ if (!dsr_info->dsr) { ++ /* Buggy or malicious guest driver */ ++ rdma_error_report("Exec command without dsr, req or rsp buffers"); ++ goto out; ++ } ++ + if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) / + sizeof(struct cmd_handler)) { + rdma_error_report("Unsupported command"); +Index: qemu-6.2.0/hw/rdma/vmw/pvrdma_main.c +=================================================================== +--- qemu-6.2.0.orig/hw/rdma/vmw/pvrdma_main.c ++++ qemu-6.2.0/hw/rdma/vmw/pvrdma_main.c +@@ -249,7 +249,8 @@ static void init_dsr_dev_caps(PVRDMADev + { + struct pvrdma_device_shared_region *dsr; + +- if (dev->dsr_info.dsr == NULL) { ++ if (!dev->dsr_info.dsr) { ++ /* Buggy or malicious guest driver */ + rdma_error_report("Can't initialized DSR"); + return; + } -- 2.32.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#164260): https://lists.openembedded.org/g/openembedded-core/message/164260 Mute This Topic: https://lists.openembedded.org/mt/90415149/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
