this should be posted to openembedded-core mailing list. On Thu, Nov 16, 2023 at 8:54 PM Niranjan Pradhan via lists.openembedded.org <nirpradh=cisco....@lists.openembedded.org> wrote: > > Upstream Repository: https://gitlab.com/qemu-project/qemu.git > > Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1544 > Type: Security Fix > CVE: CVE-2023-1544 > Score: 6.3 > Patch: https://gitlab.com/qemu-project/qemu/-/commit/85fc35afa93c > > Signed-off-by: Niranjan Pradhan <nirpr...@cisco.com> > --- > meta/recipes-devtools/qemu/qemu.inc | 1 + > .../qemu/qemu/CVE-2023-1544.patch | 70 +++++++++++++++++++ > 2 files changed, 71 insertions(+) > create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch > > diff --git a/meta/recipes-devtools/qemu/qemu.inc > b/meta/recipes-devtools/qemu/qemu.inc > index 80b5d966e4..2488edd6e6 100644 > --- a/meta/recipes-devtools/qemu/qemu.inc > +++ b/meta/recipes-devtools/qemu/qemu.inc > @@ -44,6 +44,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ > file://CVE-2023-3180.patch \ > file://CVE-2023-42467.patch \ > > file://0001-target-i386-fix-avx2-instructions-vzeroall-and-vperm.patch \ > + file://CVE-2023-1544.patch \ > " > UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" > > diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch > b/meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch > new file mode 100644 > index 0000000000..b4781e1c18 > --- /dev/null > +++ b/meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch > @@ -0,0 +1,70 @@ > +From e7d6e37675e422cfab2fe8c6bd411d2097228760 Mon Sep 17 00:00:00 2001 > +From: Yuval Shaia <yuval.shaia...@gmail.com> > +Date: Wed, 1 Mar 2023 16:29:26 +0200 > +Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver > + > +Guest driver allocates and initialize page tables to be used as a ring > +of descriptors for CQ and async events. > +The page table that represents the ring, along with the number of pages > +in the page table is passed to the device. > +Currently our device supports only one page table for a ring. > + > +Let's make sure that the number of page table entries the driver > +reports, do not exceeds the one page table size. > + > +CVE: CVE-2023-1544 > +Upstream-Status: Backport > [https://gitlab.com/qemu-project/qemu/-/commit/85fc35afa93c] > + > +Reported-by: Soul Chen <soulchen8...@gmail.com> > +Signed-off-by: Yuval Shaia <yuval.shaia...@gmail.com> > +Fixes: CVE-2023-1544 > +Message-ID: <20230301142926.18686-1-yuval.shaia...@gmail.com> > +Signed-off-by: Thomas Huth <th...@redhat.com> > +(cherry picked from commit 85fc35afa93c7320d1641d344d0c5dfbe341d087) > +Signed-off-by: Niranjan Pradhan <nirpr...@cisco.com> > +--- > + hw/rdma/vmw/pvrdma_main.c | 16 +++++++++++++++- > + 1 file changed, 15 insertions(+), 1 deletion(-) > + > +diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c > +index 4fc6712025..55b338046e 100644 > +--- a/hw/rdma/vmw/pvrdma_main.c > ++++ b/hw/rdma/vmw/pvrdma_main.c > +@@ -91,19 +91,33 @@ static int init_dev_ring(PvrdmaRing *ring, > PvrdmaRingState **ring_state, > + dma_addr_t dir_addr, uint32_t num_pages) > + { > + uint64_t *dir, *tbl; > +- int rc = 0; > ++ int max_pages, rc = 0; > + > + if (!num_pages) { > + rdma_error_report("Ring pages count must be strictly positive"); > + return -EINVAL; > + } > + > ++ /* > ++ * Make sure we can satisfy the requested number of pages in a single > ++ * TARGET_PAGE_SIZE sized page table (taking into account that first > entry > ++ * is reserved for ring-state) > ++ */ > ++ max_pages = TARGET_PAGE_SIZE / sizeof(dma_addr_t) - 1; > ++ if (num_pages > max_pages) { > ++ rdma_error_report("Maximum pages on a single directory must not > exceed %d\n", > ++ max_pages); > ++ return -EINVAL; > ++ } > ++ > + dir = rdma_pci_dma_map(pci_dev, dir_addr, TARGET_PAGE_SIZE); > + if (!dir) { > + rdma_error_report("Failed to map to page directory (ring %s)", > name); > + rc = -ENOMEM; > + goto out; > + } > ++ > ++ /* We support only one page table for a ring */ > + tbl = rdma_pci_dma_map(pci_dev, dir[0], TARGET_PAGE_SIZE); > + if (!tbl) { > + rdma_error_report("Failed to map to page table (ring %s)", name); > +-- > +2.35.6 > + > -- > 2.35.6 > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#106848): https://lists.openembedded.org/g/openembedded-devel/message/106848 Mute This Topic: https://lists.openembedded.org/mt/102642135/21656 Group Owner: openembedded-devel+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
