Blame SOURCES/kvm-migration-fix-parameter-validation-on-ram-load-CVE-2.patch

958e1b
From 6986f7c62b38d90992bd8f7c178325fc1e31d7fe Mon Sep 17 00:00:00 2001
958e1b
Message-Id: <6986f7c62b38d90992bd8f7c178325fc1e31d7fe.1418766606.git.jen@redhat.com>
958e1b
In-Reply-To: <6f81b4847eb68ebdf54a8f1a771e19d112d74152.1418766606.git.jen@redhat.com>
958e1b
References: <6f81b4847eb68ebdf54a8f1a771e19d112d74152.1418766606.git.jen@redhat.com>
958e1b
From: Amos Kong <akong@redhat.com>
958e1b
Date: Mon, 8 Dec 2014 14:53:34 -0600
958e1b
Subject: [CHANGE 31/31] migration: fix parameter validation on ram load
958e1b
 (CVE-2014-7840)
958e1b
To: rhvirt-patches@redhat.com,
958e1b
    jen@redhat.com
958e1b
958e1b
RH-Author: Amos Kong <akong@redhat.com>
958e1b
Message-id: <1418050414-25145-1-git-send-email-akong@redhat.com>
958e1b
Patchwork-id: 62762
958e1b
O-Subject: [RHEL-7.1 qemu-kvm PATCH] migration: fix parameter validation on ram load (CVE-2014-7840)
958e1b
Bugzilla: 1163078
958e1b
RH-Acked-by: Juan Quintela <quintela@redhat.com>
958e1b
RH-Acked-by: Dr. David Alan Gilbert (git) <dgilbert@redhat.com>
958e1b
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
958e1b
958e1b
From: Michael S. Tsirkin <mst@redhat.com>
958e1b
958e1b
During migration, the values read from migration stream during ram load
958e1b
are not validated. Especially offset in host_from_stream_offset() and
958e1b
also the length of the writes in the callers of said function.
958e1b
958e1b
To fix this, we need to make sure that the [offset, offset + length]
958e1b
range fits into one of the allocated memory regions.
958e1b
958e1b
Validating addr < len should be sufficient since data seems to always be
958e1b
managed in TARGET_PAGE_SIZE chunks.
958e1b
958e1b
Fixes: CVE-2014-7840
958e1b
958e1b
Note: follow-up patches add extra checks on each block->host access.
958e1b
958e1b
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
958e1b
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
958e1b
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
958e1b
Signed-off-by: Amit Shah <amit.shah@redhat.com>
958e1b
(backported from commit 0be839a2701369f669532ea5884c15bead1c6e08)
958e1b
Conflict was caused by different error reporting.
958e1b
958e1b
Signed-off-by: Amos Kong <akong@redhat.com>
958e1b
Signed-off-by: Jeff E. Nelson <jen@redhat.com>
958e1b
---
958e1b
 arch_init.c | 5 +++--
958e1b
 1 file changed, 3 insertions(+), 2 deletions(-)
958e1b
958e1b
diff --git a/arch_init.c b/arch_init.c
958e1b
index 0c2bde9..4c3d3b5 100644
958e1b
--- a/arch_init.c
958e1b
+++ b/arch_init.c
958e1b
@@ -979,7 +979,7 @@ static inline void *host_from_stream_offset(QEMUFile *f,
958e1b
     uint8_t len;
958e1b
 
958e1b
     if (flags & RAM_SAVE_FLAG_CONTINUE) {
958e1b
-        if (!block) {
958e1b
+        if (!block || block->length <= offset) {
958e1b
             fprintf(stderr, "Ack, bad migration stream!\n");
958e1b
             return NULL;
958e1b
         }
958e1b
@@ -992,8 +992,9 @@ static inline void *host_from_stream_offset(QEMUFile *f,
958e1b
     id[len] = 0;
958e1b
 
958e1b
     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
958e1b
-        if (!strncmp(id, block->idstr, sizeof(id)))
958e1b
+        if (!strncmp(id, block->idstr, sizeof(id)) && block->length > offset) {
958e1b
             return memory_region_get_ram_ptr(block->mr) + offset;
958e1b
+        }
958e1b
     }
958e1b
 
958e1b
     fprintf(stderr, "Can't find block %s!\n", id);
958e1b
-- 
958e1b
2.1.0
958e1b