From d0b7ef97c4c5fe871664f2a952c8c3b0b4417d23 Mon Sep 17 00:00:00 2001

Message-Id: <d0b7ef97c4c5fe871664f2a952c8c3b0b4417d23@dist-git>

From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>

Date: Thu, 1 Mar 2018 14:55:26 +0000

Subject: [PATCH] qemu: avoid denial of service reading from QEMU guest agent

 (CVE-2018-1064)

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

We read from the agent until seeing a \r\n pair to indicate a completed

reply or event. To avoid memory denial-of-service though, we must have a

size limit on amount of data we buffer. 10 MB is large enough that it

ought to cope with normal agent replies, and small enough that we're not

consuming unreasonable mem.

This is identical to the flaw we had reading from the QEMU monitor

as CVE-2018-5748, so rather embarrassing that we forgot to fix

the agent code at the same time.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

(cherry picked from commit fbf31e1a4cd19d6f6e33e0937a009775cd7d9513)

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>

Reviewed-by: Ján Tomko <jtomko@redhat.com>

---

 src/qemu/qemu_agent.c | 15 +++++++++++++++

 1 file changed, 15 insertions(+)

diff --git a/src/qemu/qemu_agent.c b/src/qemu/qemu_agent.c

index 5d125c4138..9cf767bd8a 100644

--- a/src/qemu/qemu_agent.c

+++ b/src/qemu/qemu_agent.c

@@ -53,6 +53,15 @@ VIR_LOG_INIT("qemu.qemu_agent");

 #define DEBUG_IO 0

 #define DEBUG_RAW_IO 0

+/* We read from QEMU until seeing a \r\n pair to indicate a

+ * completed reply or event. To avoid memory denial-of-service

+ * though, we must have a size limit on amount of data we

+ * buffer. 10 MB is large enough that it ought to cope with

+ * normal QEMU replies, and small enough that we're not

+ * consuming unreasonable mem.

+ */

+#define QEMU_AGENT_MAX_RESPONSE (10 * 1024 * 1024)

+

 /* When you are the first to uncomment this,

  * don't forget to uncomment the corresponding

  * part in qemuAgentIOProcessEvent as well.

@@ -535,6 +544,12 @@ qemuAgentIORead(qemuAgentPtr mon)

     int ret = 0;

     if (avail < 1024) {

+        if (mon->bufferLength >= QEMU_AGENT_MAX_RESPONSE) {

+            virReportSystemError(ERANGE,

+                                 _("No complete agent response found in %d bytes"),

+                                 QEMU_AGENT_MAX_RESPONSE);

+            return -1;

+        }

         if (VIR_REALLOC_N(mon->buffer,

                           mon->bufferLength + 1024) < 0)

             return -1;

-- 

2.17.0