From nobody Tue Apr 29 19:04:23 2025
Delivered-To: importer@patchew.org
Authentication-Results: mx.zohomail.com;
dkim=pass;
spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as
permitted sender)
smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org;
dmarc=pass(p=quarantine dis=none) header.from=crudebyte.com
ARC-Seal: i=1; a=rsa-sha256; t=1733827505; cv=none;
d=zohomail.com; s=zohoarc;
b=QsC+KJlYykdX71zjwYG2s2pvRRqgkwXAgbJ4TBkSWIjoc6o+K+rR+y5Da2D9q1qQvOJJLHuhYKAs5F79o7YeWtvALePp4gU17Vd5YFhskQATTEcmRJPvNWKM5QjlS1Nq8BP6Z6oc9+iNGK6EdlZiHOnSskao2NxVL4z0b1g48fM=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com;
s=zohoarc;
t=1733827505;
h=Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To;
bh=+3Wj4kR3515Tw4CQPNGUwuTJF5Hvs1ZF+MWoQXQIFbM=;
b=SL12sb8oTmZenugwkV22ZecJ1MF6ucCcyVqXVe/f3JWvu7WTZNPQYocN3daNAnGXp9mTlEo4g8uPFcbN9Krsm44XsRuPQoQgU083jzsrA+HFU9SE6NTVluXLc7Dk5apBiRFAdn6QrRXKwj7be1uv0ebod23GJwamFi9LD5R3uho=
ARC-Authentication-Results: i=1; mx.zohomail.com;
dkim=pass;
spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as
permitted sender)
smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org;
dmarc=pass header.from=<qemu_oss@crudebyte.com> (p=quarantine dis=none)
Return-Path: <qemu-devel-bounces+importer=patchew.org@nongnu.org>
Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by
mx.zohomail.com
with SMTPS id 1733827505667305.06923079383716;
Tue, 10 Dec 2024 02:45:05 -0800 (PST)
Received: from localhost ([::1] helo=lists1p.gnu.org)
by lists.gnu.org with esmtp (Exim 4.90_1)
(envelope-from <qemu-devel-bounces@nongnu.org>)
id 1tKxix-0005Jq-HT; Tue, 10 Dec 2024 05:44:15 -0500
Received: from eggs.gnu.org ([2001:470:142:3::10])
by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1)
(envelope-from
<d06a9d843fb65351e0e4dc42ba0c404f01ea92b3@kylie.crudebyte.com>)
id 1tKxiw-0005JS-Ae; Tue, 10 Dec 2024 05:44:14 -0500
Received: from kylie.crudebyte.com ([5.189.157.229])
by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1)
(envelope-from
<d06a9d843fb65351e0e4dc42ba0c404f01ea92b3@kylie.crudebyte.com>)
id 1tKxiu-0007Rg-IH; Tue, 10 Dec 2024 05:44:14 -0500
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=crudebyte.com; s=kylie; h=Cc:To:Subject:Date:From:References:In-Reply-To:
Message-Id:Content-Type:Content-Transfer-Encoding:MIME-Version:Content-ID:
Content-Description; bh=+3Wj4kR3515Tw4CQPNGUwuTJF5Hvs1ZF+MWoQXQIFbM=; b=bForn
W0UzrRj0dTO1KRjL+S33OUEyZgGsjCs/mMGDlhGNDMPz0kU1eVeitEbKRNyzs/cOigU5ZGvawpB/Q
VHz3GJ9/ZBOuglrzVX9cpZtmsh2glJ/fnJbhrJ+7qpbPCVEMmX1DudcyaON8Wlr5xYrmj4XWOhuNQ
uK9p6hqca+C9cS4GJiVggGdJjS+Ap1/QvuPlE7J6O/qf8dr771Hcx99frh+QcXf9dxFigmKhO4kFM
K2/+DzEL58ZE5evxKzNmbwsjfc+IjH5N5dBwmtoQjjMJTl5XY4XqkkuWrBiw3MwX8DAgZgMj/xRrO
ju7jqvBn/DhnaYHo4eg4lksld6bafOo6MWWGX7MSAcZm2hEZvYU0f2VDx+avpy4T1lPX2WEJFPkKN
3qp0hGZlsjujkTwJiJlkMzwmAIjTs23rkZrRu//8r0ibEca/2uJRWT1VWVJ1TqdxjHRdgvm8NCfaE
4gY/xqtjWxkRbfLO91lrpATaaKbM6swPEHvWOM0r3jLKssbuJYOC7GPWTXv1CiwFQlplTZ5++SJvd
Tq/iWzHjbQEj7z0o1JarZV1dvCpqS85YaL+/8AqRFw2VznEsF+m1Gvi/bfDLzzrn24nlBIyVPhMp6
8QnDaIuiopzy7bbD910y8IYISwm06jcKOIlw/18qB2kZ3OMq/jgrY3kt/pqXMM=;
Message-Id:
<d06a9d843fb65351e0e4dc42ba0c404f01ea92b3.1733825219.git.qemu_oss@crudebyte.com>
In-Reply-To: <cover.1733825219.git.qemu_oss@crudebyte.com>
References: <cover.1733825219.git.qemu_oss@crudebyte.com>
From: Christian Schoenebeck <qemu_oss@crudebyte.com>
Date: Tue, 10 Dec 2024 11:07:00 +0100
Subject: [PULL for-9.2 1/1] 9pfs: fix regression regarding CVE-2023-2861
To: qemu-devel@nongnu.org,
Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-stable@nongnu.org, Greg Kurz <groug@kaod.org>,
Dirk Herrendorfer <d.herrendoerfer@de.ibm.com>
Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17
as permitted sender) client-ip=209.51.188.17;
envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org;
helo=lists.gnu.org;
Received-SPF: pass client-ip=5.189.157.229;
envelope-from=d06a9d843fb65351e0e4dc42ba0c404f01ea92b3@kylie.crudebyte.com;
helo=kylie.crudebyte.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001,
RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001,
SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org
Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org
X-ZohoMail-DKIM: pass (identity @crudebyte.com)
X-ZM-MESSAGEID: 1733827506308116600
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
The released fix for this CVE:
f6b0de53fb8 ("9pfs: prevent opening special files (CVE-2023-2861)")
caused a regression with security_model=3Dpassthrough. When handling a
'Tmknod' request there was a side effect that 'Tmknod' request could fail
as 9p server was trying to adjust permissions:
#6 close_if_special_file (fd=3D30) at ../hw/9pfs/9p-util.h:140
#7 openat_file (mode=3D<optimized out>, flags=3D2228224,
name=3D<optimized out>, dirfd=3D<optimized out>) at
../hw/9pfs/9p-util.h:181
#8 fchmodat_nofollow (dirfd=3Ddirfd@entry=3D31,
name=3Dname@entry=3D0x5555577ea6e0 "mysocket", mode=3D493) at
../hw/9pfs/9p-local.c:360
#9 local_set_cred_passthrough (credp=3D0x7ffbbc4ace10, name=3D0x5555577e=
a6e0
"mysocket", dirfd=3D31, fs_ctx=3D0x55555811f528) at
../hw/9pfs/9p-local.c:457
#10 local_mknod (fs_ctx=3D0x55555811f528, dir_path=3D<optimized out>,
name=3D0x5555577ea6e0 "mysocket", credp=3D0x7ffbbc4ace10) at
../hw/9pfs/9p-local.c:702
#11 v9fs_co_mknod (pdu=3Dpdu@entry=3D0x555558121140,
fidp=3Dfidp@entry=3D0x5555574c46c0, name=3Dname@entry=3D0x7ffbbc4aced=
0,
uid=3D1000, gid=3D1000, dev=3D<optimized out>, mode=3D49645,
stbuf=3D0x7ffbbc4acef0) at ../hw/9pfs/cofs.c:205
#12 v9fs_mknod (opaque=3D0x555558121140) at ../hw/9pfs/9p.c:3711
That's because server was opening the special file to adjust permissions,
however it was using O_PATH and it would have not returned the file
descriptor to guest. So the call to close_if_special_file() on that branch
was incorrect.
Let's lift the restriction introduced by f6b0de53fb8 such that it would
allow to open special files on host if O_PATH flag is supplied, not only
for 9p server's own operations as described above, but also for any client
'Topen' request.
It is safe to allow opening special files with O_PATH on host, because
O_PATH only allows path based operations on the resulting file descriptor
and prevents I/O such as read() and write() on that file descriptor.
Fixes: f6b0de53fb8 ("9pfs: prevent opening special files (CVE-2023-2861)")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2337
Reported-by: Dirk Herrendorfer <d.herrendoerfer@de.ibm.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Tested-by: Dirk Herrendorfer <d.herrendoerfer@de.ibm.com>
Message-Id: <E1tJWbk-007BH4-OB@kylie.crudebyte.com>
---
hw/9pfs/9p-util.h | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
index 51c94b0116..95ee4da9bd 100644
--- a/hw/9pfs/9p-util.h
+++ b/hw/9pfs/9p-util.h
@@ -177,20 +177,27 @@ again:
return -1;
}
=20
- if (close_if_special_file(fd) < 0) {
- return -1;
- }
-
- serrno =3D errno;
- /* O_NONBLOCK was only needed to open the file. Let's drop it. We don't
- * do that with O_PATH since fcntl(F_SETFL) isn't supported, and opena=
t()
- * ignored it anyway.
- */
+ /* Only if O_PATH is not set ... */
if (!(flags & O_PATH_9P_UTIL)) {
+ /*
+ * Prevent I/O on special files (device files, etc.) on host side,
+ * however it is safe and required to allow opening them with O_PA=
TH,
+ * as this is limited to (required) path based operations only.
+ */
+ if (close_if_special_file(fd) < 0) {
+ return -1;
+ }
+
+ serrno =3D errno;
+ /*
+ * O_NONBLOCK was only needed to open the file. Let's drop it. We =
don't
+ * do that with O_PATH since fcntl(F_SETFL) isn't supported, and
+ * openat() ignored it anyway.
+ */
ret =3D fcntl(fd, F_SETFL, flags);
assert(!ret);
+ errno =3D serrno;
}
- errno =3D serrno;
return fd;
}
=20
--=20
2.30.2