From nobody Tue Dec 16 09:00:25 2025 Delivered-To: importer@patchew.org Received-SPF: temperror (zoho.com: Error in retrieving data from DNS) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=temperror (zoho.com: Error in retrieving data from DNS) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1512589248313176.45023829151546; Wed, 6 Dec 2017 11:40:48 -0800 (PST) Received: from localhost ([::1]:57299 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eMfYR-0006g8-Eu for importer@patchew.org; Wed, 06 Dec 2017 14:40:27 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49420) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eMfCR-0000iQ-Pm for qemu-devel@nongnu.org; Wed, 06 Dec 2017 14:17:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eMfCO-0000f9-Hf for qemu-devel@nongnu.org; Wed, 06 Dec 2017 14:17:43 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:39416 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eMfCO-0000du-BH for qemu-devel@nongnu.org; Wed, 06 Dec 2017 14:17:40 -0500 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id vB6JE94b050860 for ; Wed, 6 Dec 2017 14:17:39 -0500 Received: from e15.ny.us.ibm.com (e15.ny.us.ibm.com [129.33.205.205]) by mx0b-001b2d01.pphosted.com with ESMTP id 2epk5h2m15-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 06 Dec 2017 14:17:39 -0500 Received: from localhost by e15.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 6 Dec 2017 14:17:39 -0500 Received: from b01cxnp23033.gho.pok.ibm.com (9.57.198.28) by e15.ny.us.ibm.com (146.89.104.202) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 6 Dec 2017 14:17:35 -0500 Received: from b01ledav001.gho.pok.ibm.com (b01ledav001.gho.pok.ibm.com [9.57.199.106]) by b01cxnp23033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id vB6JHZUt57213098; Wed, 6 Dec 2017 19:17:35 GMT Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 616EE28041; Wed, 6 Dec 2017 14:17:02 -0500 (EST) Received: from localhost (unknown [9.80.93.86]) by b01ledav001.gho.pok.ibm.com (Postfix) with ESMTP id 1EF952803F; Wed, 6 Dec 2017 14:17:02 -0500 (EST) From: Michael Roth To: qemu-devel@nongnu.org Date: Wed, 6 Dec 2017 13:16:26 -0600 X-Mailer: git-send-email 2.11.0 In-Reply-To: <20171206191648.18208-1-mdroth@linux.vnet.ibm.com> References: <20171206191648.18208-1-mdroth@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 17120619-0036-0000-0000-000002976FD0 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00008161; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000244; SDB=6.00956379; UDB=6.00483442; IPR=6.00736416; BA=6.00005729; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00018387; XFM=3.00000015; UTC=2017-12-06 19:17:37 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17120619-0037-0000-0000-0000429795DE Message-Id: <20171206191648.18208-34-mdroth@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-12-06_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1712060273 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PATCH 33/55] io: monitor encoutput buffer size from websocket GSource X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_6 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: "Daniel P. Berrange" The websocket GSource is monitoring the size of the rawoutput buffer to determine if the channel can accepts more writes. The rawoutput buffer, however, is merely a temporary staging buffer before data is copied into the encoutput buffer. Thus its size will always be zero when the GSource runs. This flaw causes the encoutput buffer to grow without bound if the other end of the underlying data channel doesn't read data being sent. This can be seen with VNC if a client is on a slow WAN link and the guest OS is sending many screen updates. A malicious VNC client can act like it is on a slow link by playing a video in the guest and then reading data very slowly, causing QEMU host memory to expand arbitrarily. This issue is assigned CVE-2017-15268, publically reported in https://bugs.launchpad.net/qemu/+bug/1718964 (cherry picked from commit a7b20a8efa28e5f22c26c06cd06c2f12bc863493) Reviewed-by: Eric Blake [Dan: Added extra checks to deal with code refactored in master but not stable 2.10] Signed-off-by: Daniel P. Berrange Signed-off-by: Michael Roth --- io/channel-websock.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/io/channel-websock.c b/io/channel-websock.c index 5a3badbec2..19116dc148 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -26,7 +26,7 @@ #include "trace.h" =20 =20 -/* Max amount to allow in rawinput/rawoutput buffers */ +/* Max amount to allow in rawinput/encoutput buffers */ #define QIO_CHANNEL_WEBSOCK_MAX_BUFFER 8192 =20 #define QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN 24 @@ -1006,7 +1006,7 @@ qio_channel_websock_source_prepare(GSource *source, if (wsource->wioc->rawinput.offset) { cond |=3D G_IO_IN; } - if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { + if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { cond |=3D G_IO_OUT; } =20 @@ -1022,7 +1022,7 @@ qio_channel_websock_source_check(GSource *source) if (wsource->wioc->rawinput.offset) { cond |=3D G_IO_IN; } - if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { + if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { cond |=3D G_IO_OUT; } =20 @@ -1041,7 +1041,7 @@ qio_channel_websock_source_dispatch(GSource *source, if (wsource->wioc->rawinput.offset) { cond |=3D G_IO_IN; } - if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { + if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) { cond |=3D G_IO_OUT; } =20 --=20 2.11.0