From nobody Fri May 3 02:52:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=gmail.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 154112213292038.979104539701325; Thu, 1 Nov 2018 18:28:52 -0700 (PDT) Received: from localhost ([::1]:48639 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gIOGZ-0003fa-7K for importer@patchew.org; Thu, 01 Nov 2018 21:28:51 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51004) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gIOFi-0002Yn-5n for qemu-devel@nongnu.org; Thu, 01 Nov 2018 21:27:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gIOFf-0004tk-1I for qemu-devel@nongnu.org; Thu, 01 Nov 2018 21:27:58 -0400 Received: from mail-pf1-x441.google.com ([2607:f8b0:4864:20::441]:35211) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1gIOAk-00032y-OM; Thu, 01 Nov 2018 21:22:50 -0400 Received: by mail-pf1-x441.google.com with SMTP id z2-v6so214663pfe.2; Thu, 01 Nov 2018 18:22:50 -0700 (PDT) Received: from localhost.localdomain.localdomain ([103.65.40.101]) by smtp.gmail.com with ESMTPSA id s30-v6sm25294820pga.57.2018.11.01.18.22.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 01 Nov 2018 18:22:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=TzPHHm64GyW5UNe9HFMELeRvczqXk1MiwEwEZYBLdtg=; b=CTIpQZ3qqRxe3JfBqu58GOfGP6RYcARR1bZF+SeVZBys6Ex/35ZqSFRB3VBcW8DstU 0G37ewFpdAR4fX4Pep3mm4GiLs3j84CpaCtuGLF8S6FvzclEsxJ7cI/MjaKidSzdtFNH CWjKJu6d7GzT2dSH+/jDS6jSNhEAfVA1YDRwV50il6rdpkLBHz4vpFcQW1i/SXRDchaB tMyPTB1gq7SYvzxfBvorGkGIMYHigSMwoIYeWVnvzWAJpCPuB6OptcABybADmS3a0sJB T+f2IZeQNhU/ilzpox2xc1z5SSnJeFj+aAJHdtxGSzVejLj4grcR/wwzRtzgqTgEp6q+ v93w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=TzPHHm64GyW5UNe9HFMELeRvczqXk1MiwEwEZYBLdtg=; b=I1kLJyX8TuevB0HwqCK7e4z3xqkUCeQrJ9uh6g90Eu+13W0yBwzxVs5VeItaPCE9Mv Atjs1Yz8hZB1tMF9LdFlTL0wgbK88K2H/n+DELI55mORkjuKdeyVZIo6F1q1bdN8UETv M40fH2aU1tIo4M+e87AOvdnsPfOLtPkM8PApkmKJbzDvAeR7K70E+RNVVOoaZTxwzOYJ 4opC6lyfUpy4kyMCbqxphAmNyLsHqTrC5ERgRpS5+FV3Izz21D5ykrrDnZQdbY4lRXQ7 2LYBigaeoVwyVdJFcpKq2tLp/rAdN+CTRHrYNcEF857zbk2Vs5X80xDzkNqgW0/OkQ3q f6Ww== X-Gm-Message-State: AGRZ1gKAwFX7dp6Hv6kmNG+Epk9ojrYFaKaILn6/ItLky6radUSq8ooD PW4eTSmoKsypz050Z6dfWnE= X-Google-Smtp-Source: AJdET5fVQXjX38zS7nfPDererTMMfPzpD+O6iwfa+T+88/Dp2b27j5ILjMqTlABOlqcWcPNejRblgA== X-Received: by 2002:a65:51c6:: with SMTP id i6-v6mr9003707pgq.227.1541121769574; Thu, 01 Nov 2018 18:22:49 -0700 (PDT) From: Li Qiang To: keith.busch@intel.com, kwolf@redhat.com, mreitz@redhat.com Date: Thu, 1 Nov 2018 18:22:43 -0700 Message-Id: <1541121763-3277-1-git-send-email-liq3ea@gmail.com> X-Mailer: git-send-email 1.8.3.1 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::441 Subject: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847) X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: pbonzini@redhat.com, Li Qiang , qemu-devel@nongnu.org, qemu-block@nongnu.org, ppandit@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Currently, the nvme_cmb_ops mr doesn't check the addr and size. This can lead an oob access issue. This is triggerable in the guest. Add check to avoid this issue. Fixes CVE-2018-16847. Reported-by: Li Qiang Reviewed-by: Paolo Bonzini Signed-off-by: Li Qiang --- hw/block/nvme.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/block/nvme.c b/hw/block/nvme.c index fc7dacb..d097add 100644 --- a/hw/block/nvme.c +++ b/hw/block/nvme.c @@ -1175,6 +1175,10 @@ static void nvme_cmb_write(void *opaque, hwaddr addr= , uint64_t data, unsigned size) { NvmeCtrl *n =3D (NvmeCtrl *)opaque; + + if (addr + size > NVME_CMBSZ_GETSIZE(n->bar.cmbsz)) { + return; + } memcpy(&n->cmbuf[addr], &data, size); } =20 @@ -1183,6 +1187,9 @@ static uint64_t nvme_cmb_read(void *opaque, hwaddr ad= dr, unsigned size) uint64_t val; NvmeCtrl *n =3D (NvmeCtrl *)opaque; =20 + if (addr + size > NVME_CMBSZ_GETSIZE(n->bar.cmbsz)) { + return 0; + } memcpy(&val, &n->cmbuf[addr], size); return val; } --=20 1.8.3.1