From nobody Sat May 30 17:44:10 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1779359693; cv=none; d=zohomail.com; s=zohoarc; b=RrfNZUcMd7Pcv+wJ6OXnxxn/8Pi5PgZhZRdDD/9bSXyO1fsQOIm3mxUEbvyUtn8oCca1mUh2x9CbjDYlkJeOKG0aCYjdZbY6doQE1VVHgiBxkVYbH13vuYOiJGd7kVHhdouAu3Hkjn4acJeShcGzSjJxknls6PpQT3mG0o3Ttic= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779359693; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NDh2D03XxxqWXqUquQtaik8bHXQ5jB9JMZ3JGWFrmQQ=; b=ihFqku20WKtyDczMIfuq/lm3TXBRsHgngrRIbNkCWN2VmfNVMZQ9WrxfDpkpUfnHuMMIkr8QdcAzQgvAD2eCLufJQT4kxu8ObZ2PfzC8ThgB21aHJL4edcg4qwibDHtNqmAN+KZcBUPT+HtjG6cNHUUajGtWfDzL+LP8WbwgQBs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779359693860301.1859235984257; Thu, 21 May 2026 03:34:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQ0jC-00015S-UZ; Thu, 21 May 2026 06:34:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0jA-00014x-E7 for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:08 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0j8-0006Ff-NS for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:08 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-18-udh2P0MdP2-RSTIY4C5rxw-1; Thu, 21 May 2026 06:34:01 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 412AB19560A6; Thu, 21 May 2026 10:34:00 +0000 (UTC) Received: from berrange.com (unknown [10.44.33.98]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A25EA19560A3; Thu, 21 May 2026 10:33:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779359646; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NDh2D03XxxqWXqUquQtaik8bHXQ5jB9JMZ3JGWFrmQQ=; b=ASb/DAiGW5zJyjvjyzUGk8adO69zmDD887lWKhGIz7OSoQ8/1zDSs1W1s0ofgDk+QdqNDS GU3yI63JNdmlXjIbN5bLfGRB98PqZqymMEshnmP2+f07cXHN5/rO0eeRyslXmNQWJTKl2l 36RcXzsTf92TfHES4j3Zdpry7E4II9U= X-MC-Unique: udh2P0MdP2-RSTIY4C5rxw-1 X-Mimecast-MFC-AGG-ID: udh2P0MdP2-RSTIY4C5rxw_1779359640 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , boy juju Subject: [PATCH 1/4] ui/vnc: fix OOB read access in VNC SASL mechname array Date: Thu, 21 May 2026 11:33:50 +0100 Message-ID: <20260521103353.1645561-2-berrange@redhat.com> In-Reply-To: <20260521103353.1645561-1-berrange@redhat.com> References: <20260521103353.1645561-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1779359695042158500 When reading the SASL mechname array off the VNC connection, if malicious, the received data may contain embedded NULs. If this happens the memory buffer returned by g_strndup may be shorter than the original data. Unfortunately the code continued to index into this buffer with an offset equal to the original length. This is a potential OOB read of the array. Fixes: 5847d9e1 (ui/vnc: simplify and avoid strncpy) Reported-by: boy juju Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 --- ui/vnc-auth-sasl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c index 9964b969ac..298c8f3769 100644 --- a/ui/vnc-auth-sasl.c +++ b/ui/vnc-auth-sasl.c @@ -489,6 +489,8 @@ static int protocol_client_auth_sasl_mechname(VncState = *vs, uint8_t *data, size_ char *mechname =3D g_strndup((const char *) data, len); trace_vnc_auth_sasl_mech_choose(vs, mechname); =20 + /* If 'data' had embedded NUL the dup'd string might now be shorter */ + len =3D strlen(mechname); if (strncmp(vs->sasl.mechlist, mechname, len) =3D=3D 0) { if (vs->sasl.mechlist[len] !=3D '\0' && vs->sasl.mechlist[len] !=3D ',') { --=20 2.54.0 From nobody Sat May 30 17:44:10 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1779359692; cv=none; d=zohomail.com; s=zohoarc; b=N7BBa3nDVPvK7Q+0kUAAAc+c6ud69gpleVLYQ/p5d8O53GpcR2iCdQxHlLyKMcF35RNv5X+vtSz0n9R1fj5VpeNWvf1UcOfZkn+7+hrzmUzTwUMsDh/KBOw2F1/zkDIl5jEb5EYpRtw/+U5mIRAlo9Zu2+mZ/wxTrbKNXXVUmAQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779359692; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jlcv66msznJj7D8I4yo1le1eAtKGaoURPmq67GcrWB8=; b=K+sDG5nPTXOx5t66SEegG1iXq+5hOQ98aCGXYZNadgV24LAn4dK6d2wrDd2Rj1Zeou7iJrujRhWSqHBT2ptC5m9AtwEHGlSCJXJ82MXwJRiQrPW7wvlH9FlHSyqJPT7uvh1ndlSgpoMrUj2+y35BxJPKt6Kw9Tk+ApunFDAXEI0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779359692222881.1768695932543; Thu, 21 May 2026 03:34:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQ0jD-00015d-IG; Thu, 21 May 2026 06:34:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0jB-000157-FZ for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:09 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0j9-0006Fl-E9 for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:09 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-441-UZYWWuLvNOC_w0PthAEkcQ-1; Thu, 21 May 2026 06:34:03 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3A8DA1956059; Thu, 21 May 2026 10:34:02 +0000 (UTC) Received: from berrange.com (unknown [10.44.33.98]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B122419560A3; Thu, 21 May 2026 10:34:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779359646; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jlcv66msznJj7D8I4yo1le1eAtKGaoURPmq67GcrWB8=; b=N+zPTPphsZkaAsPhxQIvaCCoAey261Fovy8gjXJ10rn7+xAQwtaLIxMBx0MmV1NWxXQjdo /4XyzFJzJOmx2XzYkqJAidQ2VyFcX06PZOGPJicGqt68IbORgLc+BmNE6SsACiduXpQow4 C5qPbt3IDHGJaVjasIzFKPgdwLGZtGM= X-MC-Unique: UZYWWuLvNOC_w0PthAEkcQ-1 X-Mimecast-MFC-AGG-ID: UZYWWuLvNOC_w0PthAEkcQ_1779359642 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , boy juju Subject: [PATCH 2/4] ui/vnc: fix OOB write in VNC stats array Date: Thu, 21 May 2026 11:33:51 +0100 Message-ID: <20260521103353.1645561-3-berrange@redhat.com> In-Reply-To: <20260521103353.1645561-1-berrange@redhat.com> References: <20260521103353.1645561-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1779359693132158500 The VncSurface struct maintains update statistics in an array: VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS]; where the dimensions are defined as: #define VNC_STAT_RECT 64 #define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT) #define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT) If VNC_MAX_WIDTH / VNC_MAX_HEIGHT are not an exact multiple of VNC_STAT_REC, the COLS/ROWS will be undersized by 1. Unfortunately: #define VNC_MAX_HEIGHT 2160 is not a multiple of 64, so there is potential for OOB reads and writes in the 'stats' array, if the guest surface is over 2112 pixels in height. An array overflow occurs when vnc_update_stats() records new statistics, either scribbling over data later in the VncDisplay struct that 'stats' is embedded in, or performing an OOB write on the allocated struct memory. Fixes: CVE-2026-48002 Reported-by: boy juju Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 --- ui/vnc.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ui/vnc.h b/ui/vnc.h index 0750bf5f72..c8d87cd530 100644 --- a/ui/vnc.h +++ b/ui/vnc.h @@ -85,8 +85,8 @@ typedef void VncSendHextileTile(VncState *vs, #define VNC_DIRTY_BPL(x) (sizeof((x)->dirty) / VNC_MAX_HEIGHT * BITS_PER_B= YTE) =20 #define VNC_STAT_RECT 64 -#define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT) -#define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT) +#define VNC_STAT_COLS DIV_ROUND_UP(VNC_MAX_WIDTH, VNC_STAT_RECT) +#define VNC_STAT_ROWS DIV_ROUND_UP(VNC_MAX_HEIGHT, VNC_STAT_RECT) =20 #define VNC_AUTH_CHALLENGE_SIZE 16 =20 --=20 2.54.0 From nobody Sat May 30 17:44:10 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1779359685; cv=none; d=zohomail.com; s=zohoarc; b=PbUdtwZcZK3Hik7dXuPxBgTetxyVDIER65dy3Sd55Huh/BDFmn1SnANwQhsIgv8WxWA2T+77m1Zo81Zb6hTnsFKCo2Hr94qXv7frfI11DzQXmcnXjd0fPVJuh8QjBbs3jzCDpJwlTXWcNfa1efPDVcZXecg1EY73WKbpIx/ObQE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779359685; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=a4pLLYtFwu2vJHug+1PMti/u2IAeHTuHm98LVYR6w/U=; b=S5Y2jpBRIsDNlJfRV8acYmSAWsjWX72EWy9uw4WdEo5V67n2CNiFCu2CRphtp4JjKfsFTsapZQr9lVvwE+0P+UyEFs5Qg7LVziI1+78jMd83N2zlh9mMfBq18pYqaUOmk7lGHxu5tf70M4F0mYSpssgSDemfsl+jywke4NFQzGE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779359685540233.15203509846333; Thu, 21 May 2026 03:34:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQ0jE-00015k-5l; Thu, 21 May 2026 06:34:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0jB-000158-Kc for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:09 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0j9-0006Fo-SA for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:09 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-8-Za04i7ktNLam9Sih2vC9OQ-1; Thu, 21 May 2026 06:34:05 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1232618005B6 for ; Thu, 21 May 2026 10:34:04 +0000 (UTC) Received: from berrange.com (unknown [10.44.33.98]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D1B1E19560A3; Thu, 21 May 2026 10:34:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779359647; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=a4pLLYtFwu2vJHug+1PMti/u2IAeHTuHm98LVYR6w/U=; b=MvRBHjRqEByJv1NuA3B5FcylcpO7H1WiQOcADnDZycHRg52gv7dJbtajNAQVOPuOlQTKj2 Ne8qyqngYRXkDKuY1SQxl0Nhve9fmBkLCrdUySvLbuUyk4MItRQi10p/j0BFKa5IvJmGaJ /L/nNVN1sy2q8uTmElURXvQ+XS407AA= X-MC-Unique: Za04i7ktNLam9Sih2vC9OQ-1 X-Mimecast-MFC-AGG-ID: Za04i7ktNLam9Sih2vC9OQ_1779359644 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Subject: [PATCH 3/4] ui/vnc: fix OOB write in lossy rect worker code Date: Thu, 21 May 2026 11:33:52 +0100 Message-ID: <20260521103353.1645561-4-berrange@redhat.com> In-Reply-To: <20260521103353.1645561-1-berrange@redhat.com> References: <20260521103353.1645561-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1779359687437158500 Incorrect calculation of the boundary condition when tracking lossy rectangles in the worker thread will result in an OOB write which can corrupt further worker state, and/or trigger any guard pages that may lie beyond the VncWorker struct. This can be triggered through careful choice of the display resolution in the guest OS by an unprivileged user. Fixes: CVE-2026-48002 Reported-by: Marc-Andr=C3=A9 Lureau Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 --- ui/vnc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 56dd43d53f..ee567700a5 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2982,13 +2982,13 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, = int y, int w, int h) { int i, j; =20 - w =3D (x + w) / VNC_STAT_RECT; - h =3D (y + h) / VNC_STAT_RECT; + w =3D DIV_ROUND_UP((x + w), VNC_STAT_RECT); + h =3D DIV_ROUND_UP((y + h), VNC_STAT_RECT); x /=3D VNC_STAT_RECT; y /=3D VNC_STAT_RECT; =20 - for (j =3D y; j <=3D h; j++) { - for (i =3D x; i <=3D w; i++) { + for (j =3D y; j < h; j++) { + for (i =3D x; i < w; i++) { worker->lossy_rect[j][i] =3D 1; } } --=20 2.54.0 From nobody Sat May 30 17:44:10 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1779359719; cv=none; d=zohomail.com; s=zohoarc; b=Njjf+3jX1q2hJ81bll6n0IfH8BNUQhE+dHUi3JshsTMUXKBfQQZ2h+SLt6+hiSm3EgAdCIdekBxz7h8Vi5zOpD04o65uMaDum99qBj7J1ko2BsAVpdf+6qRugyvUgmlCMuhbpPgOY3Eh+OcIaKDK2+VoIdpKZsUSMigYK/V+pzc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1779359719; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=KxSBwpFmHiNc098bxYbgrvrDZSL92Uuj/fs9drvgqPU=; b=C3VD6z5X2T8hiHQ2wbSWK6vCSgRijNb3iZZ8ubCErPJT24SDYtRz0QST9k7ytjxPEecQYzraAzjJO5xNGOA95MKadJSioVNM4T8iPBONHNOI85V5HFNlxJbg0GJCkGS6bWNMmubJIbnFKN9xGUTUygUNqNjS39mWanTd0EevOw8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1779359719815817.9603172486613; Thu, 21 May 2026 03:35:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wQ0jG-00016a-Pf; Thu, 21 May 2026 06:34:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0jC-00015T-Ip for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:10 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wQ0jB-0006G7-54 for qemu-devel@nongnu.org; Thu, 21 May 2026 06:34:10 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-350-SvEzZB1pPMqNw51iZky01w-1; Thu, 21 May 2026 06:34:07 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 215241956055; Thu, 21 May 2026 10:34:06 +0000 (UTC) Received: from berrange.com (unknown [10.44.33.98]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 8AD5919560A3; Thu, 21 May 2026 10:34:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779359648; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=KxSBwpFmHiNc098bxYbgrvrDZSL92Uuj/fs9drvgqPU=; b=cHP6HGbEHSVlRrHcJs1c0tggeGNq8RTKuBLjtzHtL9HMvdo0ZzOFy7q+G+9OxxUZW7xv1v QYIDp8Js7JPZwiokLusld8YtyGByJJzmF0AKocdzrSxNE2ZY69maejoKnDCDT5M7Pd4jrn u8/9IE2H9u7Kq4F49v85CbEoIeCbvu8= X-MC-Unique: SvEzZB1pPMqNw51iZky01w-1 X-Mimecast-MFC-AGG-ID: SvEzZB1pPMqNw51iZky01w_1779359646 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , boy juju Subject: [PATCH 4/4] ui/vnc: fix OOB read updating VNC update frequency stats Date: Thu, 21 May 2026 11:33:53 +0100 Message-ID: <20260521103353.1645561-5-berrange@redhat.com> In-Reply-To: <20260521103353.1645561-1-berrange@redhat.com> References: <20260521103353.1645561-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1779359761110158500 Incorrect loop bounds in vnc_update_freq result in iterating past the last row and past the last column in the VNC stats array. With suitably chosen dimensions this could be a OOB read that accesses memory beyond the VncDisplay struct that the stats array is embedded in. Should this hit a guard page, it could trigger a guest crash. If it does not, then the VNC frequency stats will be updated with garbage. Fixes: CVE-2026-48003 Reported-by: boy juju Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 --- ui/vnc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index ee567700a5..03716d7fe9 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3091,12 +3091,14 @@ double vnc_update_freq(VncState *vs, int x, int y, = int w, int h) int i, j; double total =3D 0; int num =3D 0; + int x_end =3D x + w; + int y_end =3D y + h; =20 x =3D QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); y =3D QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); =20 - for (j =3D y; j <=3D y + h; j +=3D VNC_STAT_RECT) { - for (i =3D x; i <=3D x + w; i +=3D VNC_STAT_RECT) { + for (j =3D y; j < y_end; j +=3D VNC_STAT_RECT) { + for (i =3D x; i < x_end; i +=3D VNC_STAT_RECT) { total +=3D vnc_stat_rect(vs->vd, i, j)->freq; num++; } --=20 2.54.0