From nobody Tue Aug 25 02:49:45 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1786969137367254.94982693691986; Mon, 17 Aug 2026 05:18:57 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id DC5893FA58; Mon, 17 Aug 2026 08:18:55 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id B9C8F41BAA for ; Mon, 17 Aug 2026 08:17:58 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id EDA35417F5; Fri, 14 Aug 2026 07:15:05 -0400 (EDT) Received: from air.basealt.ru (air.basealt.ru [193.43.8.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id EC0123F836 for ; Fri, 14 Aug 2026 07:15:04 -0400 (EDT) Received: from main.malta.altlinux.ru (obninsk.basealt.ru [217.15.195.17]) (Authenticated sender: zhidkihsv) by air.basealt.ru (Postfix) with ESMTPSA id 82A1523389; Fri, 14 Aug 2026 14:07:53 +0300 (MSK) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 X-Greylist: delayed 427 seconds by postgrey-1.37 at lists.libvirt.org; Fri, 14 Aug 2026 07:15:04 EDT From: Sergey Zhidkih To: devel@lists.libvirt.org Subject: [PATCH] storage: check bounds before accessing encryption payload offset Date: Fri, 14 Aug 2026 14:07:25 +0300 Message-ID: <20260814110725.237134-1-rx1513@altlinux.org> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: rx1513@altlinux.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: 43NZOZ3Z664YD7FY7MYJYETJKPQMCVAX X-Message-ID-Hash: 43NZOZ3Z664YD7FY7MYJYETJKPQMCVAX X-Mailman-Approved-At: Mon, 17 Aug 2026 12:17:25 +0000 CC: Sergey Zhidkih X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZM-MESSAGEID: 1786969138539158500 Content-Type: text/plain; charset="utf-8" 'virStorageFileGetEncryptionPayloadOffset' expects payloadOffset + 4 to be in buffer bounds which isn't checked anywhere. For example malicious actor may provide LUKS header with just magic and version like: '4c554b53 babe 0001'. This example successefully passes 'virStorageFileHasEncryptionFormat' and leads to OOB read of 4 bytes. So the fix is to add bounds checks. Fixes: b7d44f450c06803df7df3ad380f7a5c97425c1e6 Closes: https://gitlab.com/libvirt/libvirt/-/work_items/906 Signed-off-by: Sergey Zhidkih Reviewed-by: Peter Krempa --- src/storage_file/storage_file_probe.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/storage_file/storage_file_probe.c b/src/storage_file/stora= ge_file_probe.c index cc5854d360..3ac90d698c 100644 --- a/src/storage_file/storage_file_probe.c +++ b/src/storage_file/storage_file_probe.c @@ -938,11 +938,13 @@ virStorageFileHasEncryptionFormat(const struct FileEn= cryptionInfo *info, =20 static int virStorageFileGetEncryptionPayloadOffset(const struct FileEncryptionInfo *= info, - char *buf) + char *buf, + size_t len) { int payload_offset =3D -1; =20 - if (info->payloadOffset !=3D -1) { + if (info->payloadOffset !=3D -1 && + len >=3D info->payloadOffset + sizeof(uint32_t)) { if (info->endian =3D=3D LV_LITTLE_ENDIAN) payload_offset =3D virReadBufInt32LE(buf + info->payloadOffset= ); else @@ -999,7 +1001,7 @@ virStorageFileProbeGetMetadata(virStorageSource *meta, } } meta->encryption->payload_offset =3D - virStorageFileGetEncryptionPayloadOffset(&fileTypeInfo= [meta->format].cryptInfo[i], buf); + virStorageFileGetEncryptionPayloadOffset(&fileTypeInfo= [meta->format].cryptInfo[i], buf, len); } } } --=20 2.50.1