Skip to content

Commit 2147429

Browse files
CBL-Mariner-Botkgodara912Kshitiz Godara
authored
[AUTO-CHERRYPICK] Patch qemu for CVE-2024-4467, CVE-2024-7730 [HIGH], CVE-2024-6505, CVE-2024-4693, CVE-2024-3447, CVE-2024-3567 [MEDIUM] - branch 3.0-dev (#13682)
Co-authored-by: kgodara912 <kshigodara@outlook.com> Co-authored-by: Kshitiz Godara <kgodara@microsoft.com>
1 parent bf092fc commit 2147429

7 files changed

Lines changed: 688 additions & 6 deletions

File tree

‎SPECS/qemu/CVE-2024-3447.patch‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
From b84c0a4b6103796312e7dd8c7288eaad1fb87aa7 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
3+
Date: Tue, 9 Apr 2024 16:19:27 +0200
4+
Subject: [PATCH 1/6] hw/sd/sdhci: Do not update TRNMOD when Command Inhibit
5+
(DAT) is set
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
Per "SD Host Controller Standard Specification Version 3.00":
11+
12+
* 2.2.5 Transfer Mode Register (Offset 00Ch)
13+
14+
Writes to this register shall be ignored when the Command
15+
Inhibit (DAT) in the Present State register is 1.
16+
17+
Do not update the TRNMOD register when Command Inhibit (DAT)
18+
bit is set to avoid the present-status register going out of
19+
sync, leading to malicious guest using DMA mode and overflowing
20+
the FIFO buffer:
21+
22+
$ cat << EOF | qemu-system-i386 \
23+
-display none -nographic -nodefaults \
24+
-machine accel=qtest -m 512M \
25+
-device sdhci-pci,sd-spec-version=3 \
26+
-device sd-card,drive=mydrive \
27+
-drive if=none,index=0,file=null-co://,format=raw,id=mydrive \
28+
-qtest stdio
29+
outl 0xcf8 0x80001013
30+
outl 0xcfc 0x91
31+
outl 0xcf8 0x80001001
32+
outl 0xcfc 0x06000000
33+
write 0x9100002c 0x1 0x05
34+
write 0x91000058 0x1 0x16
35+
write 0x91000005 0x1 0x04
36+
write 0x91000028 0x1 0x08
37+
write 0x16 0x1 0x21
38+
write 0x19 0x1 0x20
39+
write 0x9100000c 0x1 0x01
40+
write 0x9100000e 0x1 0x20
41+
write 0x9100000f 0x1 0x00
42+
write 0x9100000c 0x1 0x00
43+
write 0x91000020 0x1 0x00
44+
EOF
45+
46+
Stack trace (part):
47+
=================================================================
48+
==89993==ERROR: AddressSanitizer: heap-buffer-overflow on address
49+
0x615000029900 at pc 0x55d5f885700d bp 0x7ffc1e1e9470 sp 0x7ffc1e1e9468
50+
WRITE of size 1 at 0x615000029900 thread T0
51+
#0 0x55d5f885700c in sdhci_write_dataport hw/sd/sdhci.c:564:39
52+
#1 0x55d5f8849150 in sdhci_write hw/sd/sdhci.c:1223:13
53+
#2 0x55d5fa01db63 in memory_region_write_accessor system/memory.c:497:5
54+
#3 0x55d5fa01d245 in access_with_adjusted_size system/memory.c:573:18
55+
#4 0x55d5fa01b1a9 in memory_region_dispatch_write system/memory.c:1521:16
56+
#5 0x55d5fa09f5c9 in flatview_write_continue system/physmem.c:2711:23
57+
#6 0x55d5fa08f78b in flatview_write system/physmem.c:2753:12
58+
#7 0x55d5fa08f258 in address_space_write system/physmem.c:2860:18
59+
...
60+
0x615000029900 is located 0 bytes to the right of 512-byte region
61+
[0x615000029700,0x615000029900) allocated by thread T0 here:
62+
#0 0x55d5f7237b27 in __interceptor_calloc
63+
#1 0x7f9e36dd4c50 in g_malloc0
64+
#2 0x55d5f88672f7 in sdhci_pci_realize hw/sd/sdhci-pci.c:36:5
65+
#3 0x55d5f844b582 in pci_qdev_realize hw/pci/pci.c:2092:9
66+
#4 0x55d5fa2ee74b in device_set_realized hw/core/qdev.c:510:13
67+
#5 0x55d5fa325bfb in property_set_bool qom/object.c:2358:5
68+
#6 0x55d5fa31ea45 in object_property_set qom/object.c:1472:5
69+
#7 0x55d5fa332509 in object_property_set_qobject om/qom-qobject.c:28:10
70+
#8 0x55d5fa31f6ed in object_property_set_bool qom/object.c:1541:15
71+
#9 0x55d5fa2e2948 in qdev_realize hw/core/qdev.c:292:12
72+
#10 0x55d5f8eed3f1 in qdev_device_add_from_qdict system/qdev-monitor.c:719:10
73+
#11 0x55d5f8eef7ff in qdev_device_add system/qdev-monitor.c:738:11
74+
#12 0x55d5f8f211f0 in device_init_func system/vl.c:1200:11
75+
#13 0x55d5fad0877d in qemu_opts_foreach util/qemu-option.c:1135:14
76+
#14 0x55d5f8f0df9c in qemu_create_cli_devices system/vl.c:2638:5
77+
#15 0x55d5f8f0db24 in qmp_x_exit_preconfig system/vl.c:2706:5
78+
#16 0x55d5f8f14dc0 in qemu_init system/vl.c:3737:9
79+
...
80+
SUMMARY: AddressSanitizer: heap-buffer-overflow hw/sd/sdhci.c:564:39
81+
in sdhci_write_dataport
82+
83+
Add assertions to ensure the fifo_buffer[] is not overflowed by
84+
malicious accesses to the Buffer Data Port register.
85+
86+
Fixes: CVE-2024-3447
87+
Cc: qemu-stable@nongnu.org
88+
Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller")
89+
Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813
90+
Reported-by: Alexander Bulekov <alxndr@bu.edu>
91+
Reported-by: Chuhong Yuan <hslester96@gmail.com>
92+
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
93+
Message-Id: <CAFEAcA9iLiv1XGTGKeopgMa8Y9+8kvptvsb8z2OBeuy+5=NUfg@mail.gmail.com>
94+
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
95+
Message-Id: <20240409145524.27913-1-philmd@linaro.org>
96+
(cherry picked from commit 9e4b27ca6bf4974f169bbca7f3dca117b1208b6f)
97+
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
98+
99+
Upstream Reference:
100+
https://gitlab.com/qemu-project/qemu/-/commit/35a67d2aa8caf8eb0bee7d38515924c95417047e
101+
---
102+
hw/sd/sdhci.c | 8 ++++++++
103+
1 file changed, 8 insertions(+)
104+
105+
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
106+
index 40473b0..e95ea34 100644
107+
--- a/hw/sd/sdhci.c
108+
+++ b/hw/sd/sdhci.c
109+
@@ -473,6 +473,7 @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
110+
}
111+
112+
for (i = 0; i < size; i++) {
113+
+ assert(s->data_count < s->buf_maxsz);
114+
value |= s->fifo_buffer[s->data_count] << i * 8;
115+
s->data_count++;
116+
/* check if we've read all valid data (blksize bytes) from buffer */
117+
@@ -561,6 +562,7 @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
118+
}
119+
120+
for (i = 0; i < size; i++) {
121+
+ assert(s->data_count < s->buf_maxsz);
122+
s->fifo_buffer[s->data_count] = value & 0xFF;
123+
s->data_count++;
124+
value >>= 8;
125+
@@ -1208,6 +1210,12 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
126+
if (!(s->capareg & R_SDHC_CAPAB_SDMA_MASK)) {
127+
value &= ~SDHC_TRNS_DMA;
128+
}
129+
+
130+
+ /* TRNMOD writes are inhibited while Command Inhibit (DAT) is true */
131+
+ if (s->prnsts & SDHC_DATA_INHIBIT) {
132+
+ mask |= 0xffff;
133+
+ }
134+
+
135+
MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK);
136+
MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
137+
138+
--
139+
2.45.3
140+

‎SPECS/qemu/CVE-2024-3567.patch‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From 941f533e8191a08f5b0964333a9a534de2733093 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
3+
Date: Tue, 9 Apr 2024 19:54:05 +0200
4+
Subject: [PATCH 6/6] hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()
5+
MIME-Version: 1.0
6+
Content-Type: text/plain; charset=UTF-8
7+
Content-Transfer-Encoding: 8bit
8+
9+
If a fragmented packet size is too short, do not try to
10+
calculate its checksum.
11+
12+
Reproduced using:
13+
14+
$ cat << EOF | qemu-system-i386 -display none -nodefaults \
15+
-machine q35,accel=qtest -m 32M \
16+
-device igb,netdev=net0 \
17+
-netdev user,id=net0 \
18+
-qtest stdio
19+
outl 0xcf8 0x80000810
20+
outl 0xcfc 0xe0000000
21+
outl 0xcf8 0x80000804
22+
outw 0xcfc 0x06
23+
write 0xe0000403 0x1 0x02
24+
writel 0xe0003808 0xffffffff
25+
write 0xe000381a 0x1 0x5b
26+
write 0xe000381b 0x1 0x00
27+
EOF
28+
Assertion failed: (offset == 0), function iov_from_buf_full, file util/iov.c, line 39.
29+
#1 0x5575e81e952a in iov_from_buf_full qemu/util/iov.c:39:5
30+
#2 0x5575e6500768 in net_tx_pkt_update_sctp_checksum qemu/hw/net/net_tx_pkt.c:144:9
31+
#3 0x5575e659f3e1 in igb_setup_tx_offloads qemu/hw/net/igb_core.c:478:11
32+
#4 0x5575e659f3e1 in igb_tx_pkt_send qemu/hw/net/igb_core.c:552:10
33+
#5 0x5575e659f3e1 in igb_process_tx_desc qemu/hw/net/igb_core.c:671:17
34+
#6 0x5575e659f3e1 in igb_start_xmit qemu/hw/net/igb_core.c:903:9
35+
#7 0x5575e659f3e1 in igb_set_tdt qemu/hw/net/igb_core.c:2812:5
36+
#8 0x5575e657d6a4 in igb_core_write qemu/hw/net/igb_core.c:4248:9
37+
38+
Fixes: CVE-2024-3567
39+
Cc: qemu-stable@nongnu.org
40+
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
41+
Fixes: f199b13bc1 ("igb: Implement Tx SCTP CSO")
42+
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2273
43+
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
44+
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
45+
Acked-by: Jason Wang <jasowang@redhat.com>
46+
Message-Id: <20240410070459.49112-1-philmd@linaro.org>
47+
(cherry picked from commit 83ddb3dbba2ee0f1767442ae6ee665058aeb1093)
48+
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
49+
50+
Upstream reference:
51+
https://gitlab.com/qemu-project/qemu/-/commit/1cfe45956e03070f894e91b304e233b4d5b99719
52+
---
53+
hw/net/net_tx_pkt.c | 4 ++++
54+
1 file changed, 4 insertions(+)
55+
56+
diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
57+
index 2e5f58b..d40d508 100644
58+
--- a/hw/net/net_tx_pkt.c
59+
+++ b/hw/net/net_tx_pkt.c
60+
@@ -141,6 +141,10 @@ bool net_tx_pkt_update_sctp_checksum(struct NetTxPkt *pkt)
61+
uint32_t csum = 0;
62+
struct iovec *pl_start_frag = pkt->vec + NET_TX_PKT_PL_START_FRAG;
63+
64+
+ if (iov_size(pl_start_frag, pkt->payload_frags) < 8 + sizeof(csum)) {
65+
+ return false;
66+
+ }
67+
+
68+
if (iov_from_buf(pl_start_frag, pkt->payload_frags, 8, &csum, sizeof(csum)) < sizeof(csum)) {
69+
return false;
70+
}
71+
--
72+
2.45.3
73+

‎SPECS/qemu/CVE-2024-4467.patch‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
From cd7055d9d5ade0e9ccf468da8742f7f1ace0fb88 Mon Sep 17 00:00:00 2001
2+
From: Kevin Wolf <kwolf@redhat.com>
3+
Date: Thu, 11 Apr 2024 15:06:01 +0200
4+
Subject: [PATCH 2/6] qcow2: Don't open data_file with BDRV_O_NO_IO
5+
6+
One use case for 'qemu-img info' is verifying that untrusted images
7+
don't reference an unwanted external file, be it as a backing file or an
8+
external data file. To make sure that calling 'qemu-img info' can't
9+
already have undesired side effects with a malicious image, just don't
10+
open the data file at all with BDRV_O_NO_IO. If nothing ever tries to do
11+
I/O, we don't need to have it open.
12+
13+
This changes the output of iotests case 061, which used 'qemu-img info'
14+
to show that opening an image with an invalid data file fails. After
15+
this patch, it succeeds. Replace this part of the test with a qemu-io
16+
call, but keep the final 'qemu-img info' to show that the invalid data
17+
file is correctly displayed in the output.
18+
19+
Fixes: CVE-2024-4467
20+
Cc: qemu-stable@nongnu.org
21+
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
22+
Reviewed-by: Eric Blake <eblake@redhat.com>
23+
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
24+
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
25+
26+
Upstream reference:
27+
https://gitlab.com/qemu-project/qemu/-/commit/bd385a5298d7062668e804d73944d52aec9549f1
28+
---
29+
block/qcow2.c | 17 ++++++++++++++++-
30+
tests/qemu-iotests/061 | 6 ++++--
31+
tests/qemu-iotests/061.out | 8 ++++++--
32+
3 files changed, 26 insertions(+), 5 deletions(-)
33+
34+
diff --git a/block/qcow2.c b/block/qcow2.c
35+
index 13e032b..7af7c0b 100644
36+
--- a/block/qcow2.c
37+
+++ b/block/qcow2.c
38+
@@ -1636,7 +1636,22 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
39+
goto fail;
40+
}
41+
42+
- if (open_data_file) {
43+
+ if (open_data_file && (flags & BDRV_O_NO_IO)) {
44+
+ /*
45+
+ * Don't open the data file for 'qemu-img info' so that it can be used
46+
+ * to verify that an untrusted qcow2 image doesn't refer to external
47+
+ * files.
48+
+ *
49+
+ * Note: This still makes has_data_file() return true.
50+
+ */
51+
+ if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
52+
+ s->data_file = NULL;
53+
+ } else {
54+
+ s->data_file = bs->file;
55+
+ }
56+
+ qdict_extract_subqdict(options, NULL, "data-file.");
57+
+ qdict_del(options, "data-file");
58+
+ } else if (open_data_file) {
59+
/* Open external data file */
60+
bdrv_graph_co_rdunlock();
61+
s->data_file = bdrv_co_open_child(NULL, options, "data-file", bs,
62+
diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061
63+
index 53c7d42..b71ac09 100755
64+
--- a/tests/qemu-iotests/061
65+
+++ b/tests/qemu-iotests/061
66+
@@ -326,12 +326,14 @@ $QEMU_IMG amend -o "data_file=foo" "$TEST_IMG"
67+
echo
68+
_make_test_img -o "compat=1.1,data_file=$TEST_IMG.data" 64M
69+
$QEMU_IMG amend -o "data_file=foo" "$TEST_IMG"
70+
-_img_info --format-specific
71+
+$QEMU_IO -c "read 0 4k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
72+
+$QEMU_IO -c "open -o data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" -c "read 0 4k" | _filter_qemu_io
73+
TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts
74+
75+
echo
76+
$QEMU_IMG amend -o "data_file=" --image-opts "data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG"
77+
-_img_info --format-specific
78+
+$QEMU_IO -c "read 0 4k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
79+
+$QEMU_IO -c "open -o data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" -c "read 0 4k" | _filter_qemu_io
80+
TEST_IMG="data-file.filename=$TEST_IMG.data,file.filename=$TEST_IMG" _img_info --format-specific --image-opts
81+
82+
echo
83+
diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out
84+
index 139fc68..24c33ad 100644
85+
--- a/tests/qemu-iotests/061.out
86+
+++ b/tests/qemu-iotests/061.out
87+
@@ -545,7 +545,9 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
88+
qemu-img: data-file can only be set for images that use an external data file
89+
90+
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 data_file=TEST_DIR/t.IMGFMT.data
91+
-qemu-img: Could not open 'TEST_DIR/t.IMGFMT': Could not open 'foo': No such file or directory
92+
+qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open 'foo': No such file or directory
93+
+read 4096/4096 bytes at offset 0
94+
+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
95+
image: TEST_DIR/t.IMGFMT
96+
file format: IMGFMT
97+
virtual size: 64 MiB (67108864 bytes)
98+
@@ -560,7 +562,9 @@ Format specific information:
99+
corrupt: false
100+
extended l2: false
101+
102+
-qemu-img: Could not open 'TEST_DIR/t.IMGFMT': 'data-file' is required for this image
103+
+qemu-io: can't open device TEST_DIR/t.IMGFMT: 'data-file' is required for this image
104+
+read 4096/4096 bytes at offset 0
105+
+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
106+
image: TEST_DIR/t.IMGFMT
107+
file format: IMGFMT
108+
virtual size: 64 MiB (67108864 bytes)
109+
--
110+
2.45.3
111+

0 commit comments

Comments
 (0)