|
|
0a122b |
From eabeace95bfc1dd3c2280105c4fa83195c7bd4bd Mon Sep 17 00:00:00 2001
|
|
|
0a122b |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Date: Tue, 25 Mar 2014 14:23:54 +0100
|
|
|
0a122b |
Subject: [PATCH 47/49] parallels: Fix catalog size integer overflow (CVE-2014-0143)
|
|
|
0a122b |
|
|
|
0a122b |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
Message-id: <1395753835-7591-48-git-send-email-kwolf@redhat.com>
|
|
|
0a122b |
Patchwork-id: n/a
|
|
|
0a122b |
O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 47/48] parallels: Fix catalog size integer overflow (CVE-2014-0143)
|
|
|
0a122b |
Bugzilla: 1079320
|
|
|
0a122b |
RH-Acked-by: Jeff Cody <jcody@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
0a122b |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
0a122b |
|
|
|
0a122b |
Bugzilla: https:
|
|
|
0a122b |
Upstream status: Embargoed
|
|
|
0a122b |
|
|
|
0a122b |
The first test case would cause a huge memory allocation, leading to a
|
|
|
0a122b |
qemu abort; the second one to a too small malloc() for the catalog
|
|
|
0a122b |
(smaller than s->catalog_size), which causes a read-only out-of-bounds
|
|
|
0a122b |
array access and on big endian hosts an endianess conversion for an
|
|
|
0a122b |
undefined memory area.
|
|
|
0a122b |
|
|
|
0a122b |
The sample image used here is not an original Parallels image. It was
|
|
|
0a122b |
created using an hexeditor on the basis of the struct that qemu uses.
|
|
|
0a122b |
Good enough for trying to crash the driver, but not for ensuring
|
|
|
0a122b |
compatibility.
|
|
|
0a122b |
|
|
|
0a122b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
|
|
|
0a122b |
Conflicts:
|
|
|
0a122b |
tests/qemu-iotests/group
|
|
|
0a122b |
|
|
|
0a122b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
0a122b |
|
|
|
0a122b |
block/parallels.c | 7 ++-
|
|
|
0a122b |
tests/qemu-iotests/076 | 69 ++++++++++++++++++++
|
|
|
0a122b |
tests/qemu-iotests/076.out | 14 ++++
|
|
|
0a122b |
tests/qemu-iotests/common | 7 ++
|
|
|
0a122b |
tests/qemu-iotests/group | 1 +
|
|
|
0a122b |
.../qemu-iotests/sample_images/fake.parallels.bz2 | Bin 0 -> 141 bytes
|
|
|
0a122b |
6 files changed, 97 insertions(+), 1 deletions(-)
|
|
|
0a122b |
create mode 100755 tests/qemu-iotests/076
|
|
|
0a122b |
create mode 100644 tests/qemu-iotests/076.out
|
|
|
0a122b |
create mode 100644 tests/qemu-iotests/sample_images/fake.parallels.bz2
|
|
|
0a122b |
|
|
|
0a122b |
diff
|
|
|
0a122b |
index 2121e43..5d1c0af 100644
|
|
|
0a122b |
|
|
|
0a122b |
|
|
|
0a122b |
@@ -49,7 +49,7 @@ typedef struct BDRVParallelsState {
|
|
|
0a122b |
CoMutex lock;
|
|
|
0a122b |
|
|
|
0a122b |
uint32_t *catalog_bitmap;
|
|
|
0a122b |
- int catalog_size;
|
|
|
0a122b |
+ unsigned int catalog_size;
|
|
|
0a122b |
|
|
|
0a122b |
int tracks;
|
|
|
0a122b |
} BDRVParallelsState;
|
|
|
0a122b |
@@ -94,6 +94,11 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
|
|
|
0a122b |
s->tracks = le32_to_cpu(ph.tracks);
|
|
|
0a122b |
|
|
|
0a122b |
s->catalog_size = le32_to_cpu(ph.catalog_entries);
|
|
|
0a122b |
+ if (s->catalog_size > INT_MAX / 4) {
|
|
|
0a122b |
+ error_setg(errp, "Catalog too large");
|
|
|
0a122b |
+ ret = -EFBIG;
|
|
|
0a122b |
+ goto fail;
|
|
|
0a122b |
+ }
|
|
|
0a122b |
s->catalog_bitmap = g_malloc(s->catalog_size * 4);
|
|
|
0a122b |
|
|
|
0a122b |
ret = bdrv_pread(bs->file, 64, s->catalog_bitmap, s->catalog_size * 4);
|
|
|
0a122b |
diff
|
|
|
0a122b |
new file mode 100755
|
|
|
0a122b |
index 0000000..6028ac5
|
|
|
0a122b |
--- /dev/null
|
|
|
0a122b |
|
|
|
0a122b |
@@ -0,0 +1,69 @@
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+# parallels format input validation tests
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+# This program is free software; you can redistribute it and/or modify
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+owner=kwolf@redhat.com
|
|
|
0a122b |
+
|
|
|
0a122b |
+seq=`basename $0`
|
|
|
0a122b |
+echo "QA output created by $seq"
|
|
|
0a122b |
+
|
|
|
0a122b |
+here=`pwd`
|
|
|
0a122b |
+tmp=/tmp/$$
|
|
|
0a122b |
+status=1
|
|
|
0a122b |
+
|
|
|
0a122b |
+_cleanup()
|
|
|
0a122b |
+{
|
|
|
0a122b |
+ _cleanup_test_img
|
|
|
0a122b |
+}
|
|
|
0a122b |
+trap "_cleanup; exit \$status" 0 1 2 3 15
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+. ./common.rc
|
|
|
0a122b |
+. ./common.filter
|
|
|
0a122b |
+
|
|
|
0a122b |
+_supported_fmt parallels
|
|
|
0a122b |
+_supported_proto generic
|
|
|
0a122b |
+_supported_os Linux
|
|
|
0a122b |
+
|
|
|
0a122b |
+catalog_entries_offset=$((0x20))
|
|
|
0a122b |
+nb_sectors_offset=$((0x24))
|
|
|
0a122b |
+
|
|
|
0a122b |
+echo
|
|
|
0a122b |
+echo "== Read from a valid (enough) image =="
|
|
|
0a122b |
+_use_sample_img fake.parallels.bz2
|
|
|
0a122b |
+{ $QEMU_IO -c "read -P 0x11 0 64k" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
0a122b |
+
|
|
|
0a122b |
+echo
|
|
|
0a122b |
+echo "== Negative catalog size =="
|
|
|
0a122b |
+_use_sample_img fake.parallels.bz2
|
|
|
0a122b |
+poke_file "$TEST_IMG" "$catalog_entries_offset" "\xff\xff\xff\xff"
|
|
|
0a122b |
+{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
0a122b |
+
|
|
|
0a122b |
+echo
|
|
|
0a122b |
+echo "== Overflow in catalog allocation =="
|
|
|
0a122b |
+_use_sample_img fake.parallels.bz2
|
|
|
0a122b |
+poke_file "$TEST_IMG" "$nb_sectors_offset" "\xff\xff\xff\xff"
|
|
|
0a122b |
+poke_file "$TEST_IMG" "$catalog_entries_offset" "\x01\x00\x00\x40"
|
|
|
0a122b |
+{ $QEMU_IO -c "read 64M 64M" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir
|
|
|
0a122b |
+
|
|
|
0a122b |
+
|
|
|
0a122b |
+echo "*** done"
|
|
|
0a122b |
+rm -f $seq.full
|
|
|
0a122b |
+status=0
|
|
|
0a122b |
diff
|
|
|
0a122b |
new file mode 100644
|
|
|
0a122b |
index 0000000..12af42a
|
|
|
0a122b |
--- /dev/null
|
|
|
0a122b |
+++ b/tests/qemu-iotests/076.out
|
|
|
0a122b |
@@ -0,0 +1,14 @@
|
|
|
0a122b |
+QA output created by 076
|
|
|
0a122b |
+
|
|
|
0a122b |
+== Read from a valid (enough) image ==
|
|
|
0a122b |
+read 65536/65536 bytes at offset 0
|
|
|
0a122b |
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
0a122b |
+
|
|
|
0a122b |
+== Negative catalog size ==
|
|
|
0a122b |
+qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
|
|
|
0a122b |
+no file open, try 'help open'
|
|
|
0a122b |
+
|
|
|
0a122b |
+== Overflow in catalog allocation ==
|
|
|
0a122b |
+qemu-io: can't open device TEST_DIR/fake.parallels: Catalog too large
|
|
|
0a122b |
+no file open, try 'help open'
|
|
|
0a122b |
+*** done
|
|
|
0a122b |
diff
|
|
|
0a122b |
index 35abbfc..f8c1b56 100644
|
|
|
0a122b |
|
|
|
0a122b |
|
|
|
0a122b |
@@ -131,6 +131,7 @@ check options
|
|
|
0a122b |
-bochs test bochs
|
|
|
0a122b |
-cow test cow
|
|
|
0a122b |
-cloop test cloop
|
|
|
0a122b |
+ -parallels test parallels
|
|
|
0a122b |
-qcow test qcow
|
|
|
0a122b |
-qcow2 test qcow2
|
|
|
0a122b |
-qed test qed
|
|
|
0a122b |
@@ -181,6 +182,12 @@ testlist options
|
|
|
0a122b |
xpand=false
|
|
|
0a122b |
|
|
|
0a122b |
|
|
|
0a122b |
+ -parallels)
|
|
|
0a122b |
+ IMGFMT=parallels
|
|
|
0a122b |
+ IMGFMT_GENERIC=false
|
|
|
0a122b |
+ xpand=false
|
|
|
0a122b |
+ ;;
|
|
|
0a122b |
+
|
|
|
0a122b |
-qcow)
|
|
|
0a122b |
IMGFMT=qcow
|
|
|
0a122b |
xpand=false
|
|
|
0a122b |
diff
|
|
|
0a122b |
index e8ad780..ad96fcf 100644
|
|
|
0a122b |
|
|
|
0a122b |
|
|
|
0a122b |
@@ -72,6 +72,7 @@
|
|
|
0a122b |
068 rw auto
|
|
|
0a122b |
070 rw auto
|
|
|
0a122b |
075 rw auto
|
|
|
0a122b |
+076 auto
|
|
|
0a122b |
077 rw auto
|
|
|
0a122b |
078 rw auto
|
|
|
0a122b |
079 rw auto
|
|
|
0a122b |
--
|
|
|
0a122b |
1.7.1
|
|
|
0a122b |
|