On Sun, Dec 14, 2025 at 10:19 AM zhenwei pi <[email protected]> wrote:
>
> The total lenght of request is limited by cryptodev config, verify it
> to avoid unexpected request from guest.
CVE-2025-14876 has been assigned to this bug.
Thanks,
> Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm")
> Reported-by: AM 이재영 <[email protected]>
> Signed-off-by: zhenwei pi <[email protected]>
> ---
> hw/virtio/virtio-crypto.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
> index 517f2089c5..94dbf9d92d 100644
> --- a/hw/virtio/virtio-crypto.c
> +++ b/hw/virtio/virtio-crypto.c
> @@ -767,11 +767,18 @@ virtio_crypto_handle_asym_req(VirtIOCrypto *vcrypto,
> uint32_t len;
> uint8_t *src = NULL;
> uint8_t *dst = NULL;
> + uint64_t max_len;
>
> asym_op_info = g_new0(CryptoDevBackendAsymOpInfo, 1);
> src_len = ldl_le_p(&req->para.src_data_len);
> dst_len = ldl_le_p(&req->para.dst_data_len);
>
> + max_len = src_len + dst_len;
> + if (unlikely(max_len > vcrypto->conf.max_size)) {
> + virtio_error(vdev, "virtio-crypto asym too big length");
> + goto err;
> + }
> +
> if (src_len > 0) {
> src = g_malloc0(src_len);
> len = iov_to_buf(iov, out_num, 0, src, src_len);
> --
> 2.43.0
>
--
Mauro Matteo Cascella
Red Hat Product Security
PGP-Key ID: BB3410B0
