display/qxl-render: fix race condition in qxl_cursor (CVE-2022-4207)

[PATCH] display/qxl-render: fix race condition in qxl_cursor (CVE-2022-4207)

Posted by Mauro Matteo Cascella 3 years, 10 months ago

Avoid fetching 'width' and 'height' a second time to prevent possible
race condition. Refer to security advisory
https://starlabs.sg/advisories/22-4207/ for more information.

Fixes: CVE-2022-4207
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
---
 hw/display/qxl-render.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
index d28849b121..237ed293ba 100644
--- a/hw/display/qxl-render.c
+++ b/hw/display/qxl-render.c
@@ -266,7 +266,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
         }
         break;
     case SPICE_CURSOR_TYPE_ALPHA:
-        size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;
+        size = sizeof(uint32_t) * c->width * c->height;
         qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id);
         if (qxl->debug > 2) {
             cursor_print_ascii_art(c, "qxl/alpha");
-- 
2.35.1

Re: [PATCH] display/qxl-render: fix race condition in qxl_cursor (CVE-2022-4207)

Posted by Gerd Hoffmann 3 years, 10 months ago

On Tue, Apr 05, 2022 at 12:35:05PM +0200, Mauro Matteo Cascella wrote:
> Avoid fetching 'width' and 'height' a second time to prevent possible
> race condition. Refer to security advisory
> https://starlabs.sg/advisories/22-4207/ for more information.
> 
> Fixes: CVE-2022-4207
> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

take care,
  Gerd

Re: [PATCH] display/qxl-render: fix race condition in qxl_cursor (CVE-2022-4207)

Posted by Marc-André Lureau 3 years, 10 months ago

On Tue, Apr 5, 2022 at 2:55 PM Mauro Matteo Cascella <mcascell@redhat.com>
wrote:

> Avoid fetching 'width' and 'height' a second time to prevent possible
> race condition. Refer to security advisory
> https://starlabs.sg/advisories/22-4207/ for more information.
>
> Fixes: CVE-2022-4207
> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>


> ---
>  hw/display/qxl-render.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
> index d28849b121..237ed293ba 100644
> --- a/hw/display/qxl-render.c
> +++ b/hw/display/qxl-render.c
> @@ -266,7 +266,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl,
> QXLCursor *cursor,
>          }
>          break;
>      case SPICE_CURSOR_TYPE_ALPHA:
> -        size = sizeof(uint32_t) * cursor->header.width *
> cursor->header.height;
> +        size = sizeof(uint32_t) * c->width * c->height;
>          qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id);
>          if (qxl->debug > 2) {
>              cursor_print_ascii_art(c, "qxl/alpha");
> --
> 2.35.1
>
>
>

-- 
Marc-André Lureau