| From ba8c0cc73f3a13b5621c8fe44eb8af20ddb9c5d0 Mon Sep 17 00:00:00 2001 |
| From: Stefan Hajnoczi <stefanha@redhat.com> |
| Date: Tue, 25 Mar 2014 14:23:11 +0100 |
| Subject: [PATCH 04/49] block/cloop: validate block_size header field (CVE-2014-0144) |
| |
| RH-Author: Kevin Wolf <kwolf@redhat.com> |
| Message-id: <1395753835-7591-5-git-send-email-kwolf@redhat.com> |
| Patchwork-id: n/a |
| O-Subject: [virt-devel] [EMBARGOED RHEL-7.0 qemu-kvm PATCH 04/48] block/cloop: validate block_size header field (CVE-2014-0144) |
| Bugzilla: 1079455 |
| RH-Acked-by: Jeff Cody <jcody@redhat.com> |
| RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com> |
| RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com> |
| |
| From: Stefan Hajnoczi <stefanha@redhat.com> |
| |
| Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1079455 |
| Upstream status: Embargoed |
| |
| Avoid unbounded s->uncompressed_block memory allocation by checking that |
| the block_size header field has a reasonable value. Also enforce the |
| assumption that the value is a non-zero multiple of 512. |
| |
| These constraints conform to cloop 2.639's code so we accept existing |
| image files. |
| |
| Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
| Signed-off-by: Kevin Wolf <kwolf@redhat.com> |
| |
| block/cloop.c | 23 +++++++++++++++++++++++ |
| tests/qemu-iotests/075 | 20 ++++++++++++++++++++ |
| tests/qemu-iotests/075.out | 12 ++++++++++++ |
| 3 files changed, 55 insertions(+), 0 deletions(-) |
| |
| diff --git a/block/cloop.c b/block/cloop.c |
| index b907023..f021663 100644 |
| |
| |
| @@ -26,6 +26,9 @@ |
| #include "qemu/module.h" |
| #include <zlib.h> |
| |
| +/* Maximum compressed block size */ |
| +#define MAX_BLOCK_SIZE (64 * 1024 * 1024) |
| + |
| typedef struct BDRVCloopState { |
| CoMutex lock; |
| uint32_t block_size; |
| @@ -68,6 +71,26 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags, |
| return ret; |
| } |
| s->block_size = be32_to_cpu(s->block_size); |
| + if (s->block_size % 512) { |
| + error_setg(errp, "block_size %u must be a multiple of 512", |
| + s->block_size); |
| + return -EINVAL; |
| + } |
| + if (s->block_size == 0) { |
| + error_setg(errp, "block_size cannot be zero"); |
| + return -EINVAL; |
| + } |
| + |
| + /* cloop's create_compressed_fs.c warns about block sizes beyond 256 KB but |
| + * we can accept more. Prevent ridiculous values like 4 GB - 1 since we |
| + * need a buffer this big. |
| + */ |
| + if (s->block_size > MAX_BLOCK_SIZE) { |
| + error_setg(errp, "block_size %u must be %u MB or less", |
| + s->block_size, |
| + MAX_BLOCK_SIZE / (1024 * 1024)); |
| + return -EINVAL; |
| + } |
| |
| ret = bdrv_pread(bs->file, 128 + 4, &s->n_blocks, 4); |
| if (ret < 0) { |
| diff --git a/tests/qemu-iotests/075 b/tests/qemu-iotests/075 |
| index 88ae8bb..8f54a99 100755 |
| |
| |
| @@ -42,11 +42,31 @@ _supported_fmt cloop |
| _supported_proto generic |
| _supported_os Linux |
| |
| +block_size_offset=128 |
| + |
| echo |
| echo "== check that the first sector can be read ==" |
| _use_sample_img simple-pattern.cloop.bz2 |
| $QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir |
| |
| +echo |
| +echo "== block_size must be a multiple of 512 ==" |
| +_use_sample_img simple-pattern.cloop.bz2 |
| +poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x02\x01" |
| +$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir |
| + |
| +echo |
| +echo "== block_size cannot be zero ==" |
| +_use_sample_img simple-pattern.cloop.bz2 |
| +poke_file "$TEST_IMG" "$block_size_offset" "\x00\x00\x00\x00" |
| +$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir |
| + |
| +echo |
| +echo "== huge block_size ===" |
| +_use_sample_img simple-pattern.cloop.bz2 |
| +poke_file "$TEST_IMG" "$block_size_offset" "\xff\xff\xfe\x00" |
| +$QEMU_IO -c "read 0 512" $TEST_IMG 2>&1 | _filter_qemu_io | _filter_testdir |
| + |
| # success, all done |
| echo "*** done" |
| rm -f $seq.full |
| diff --git a/tests/qemu-iotests/075.out b/tests/qemu-iotests/075.out |
| index 26661fa..d362c95 100644 |
| |
| |
| @@ -3,4 +3,16 @@ QA output created by 075 |
| == check that the first sector can be read == |
| read 512/512 bytes at offset 0 |
| 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) |
| + |
| +== block_size must be a multiple of 512 == |
| +qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 513 must be a multiple of 512 |
| +no file open, try 'help open' |
| + |
| +== block_size cannot be zero == |
| +qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size cannot be zero |
| +no file open, try 'help open' |
| + |
| +== huge block_size === |
| +qemu-io: can't open device TEST_DIR/simple-pattern.cloop: block_size 4294966784 must be 64 MB or less |
| +no file open, try 'help open' |
| *** done |
| -- |
| 1.7.1 |
| |