From 7365e91f31de62603e27bdae8f25d47fdcebf548 Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Wed, 20 Sep 2023 11:39:50 +0800 Subject: [PATCH] Fix CVE-2023-3354 --- 1029-anolis-qemu-fix-CVE-2023-3354.patch | 80 ++++++++++++++++++++++++ qemu-kvm.spec | 5 +- 2 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 1029-anolis-qemu-fix-CVE-2023-3354.patch diff --git a/1029-anolis-qemu-fix-CVE-2023-3354.patch b/1029-anolis-qemu-fix-CVE-2023-3354.patch new file mode 100644 index 0000000..345ed05 --- /dev/null +++ b/1029-anolis-qemu-fix-CVE-2023-3354.patch @@ -0,0 +1,80 @@ +From 10be627d2b5ec2d6b3dce045144aa739eef678b4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Tue, 20 Jun 2023 09:45:34 +0100 +Subject: [PATCH] io: remove io watch if TLS channel is closed during handshake +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The TLS handshake make take some time to complete, during which time an +I/O watch might be registered with the main loop. If the owner of the +I/O channel invokes qio_channel_close() while the handshake is waiting +to continue the I/O watch must be removed. Failing to remove it will +later trigger the completion callback which the owner is not expecting +to receive. In the case of the VNC server, this results in a SEGV as +vnc_disconnect_start() tries to shutdown a client connection that is +already gone / NULL. + +CVE-2023-3354 +Reported-by: jiangyegen +Signed-off-by: Daniel P. Berrangé +--- + include/io/channel-tls.h | 1 + + io/channel-tls.c | 18 ++++++++++++------ + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h +index 5672479e9eb6..26c67f17e2d3 100644 +--- a/include/io/channel-tls.h ++++ b/include/io/channel-tls.h +@@ -48,6 +48,7 @@ struct QIOChannelTLS { + QIOChannel *master; + QCryptoTLSSession *session; + QIOChannelShutdown shutdown; ++ guint hs_ioc_tag; + }; + + /** +diff --git a/io/channel-tls.c b/io/channel-tls.c +index 9805dd0a3f64..847d5297c339 100644 +--- a/io/channel-tls.c ++++ b/io/channel-tls.c +@@ -198,12 +198,13 @@ static void qio_channel_tls_handshake_task(QIOChannelTLS *ioc, + } + + trace_qio_channel_tls_handshake_pending(ioc, status); +- qio_channel_add_watch_full(ioc->master, +- condition, +- qio_channel_tls_handshake_io, +- data, +- NULL, +- context); ++ ioc->hs_ioc_tag = ++ qio_channel_add_watch_full(ioc->master, ++ condition, ++ qio_channel_tls_handshake_io, ++ data, ++ NULL, ++ context); + } + } + +@@ -218,6 +219,7 @@ static gboolean qio_channel_tls_handshake_io(QIOChannel *ioc, + QIOChannelTLS *tioc = QIO_CHANNEL_TLS( + qio_task_get_source(task)); + ++ tioc->hs_ioc_tag = 0; + g_free(data); + qio_channel_tls_handshake_task(tioc, task, context); + +@@ -378,6 +380,10 @@ static int qio_channel_tls_close(QIOChannel *ioc, + { + QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc); + ++ if (tioc->hs_ioc_tag) { ++ g_clear_handle_id(&tioc->hs_ioc_tag, g_source_remove); ++ } ++ + return qio_channel_close(tioc->master, errp); + } + diff --git a/qemu-kvm.spec b/qemu-kvm.spec index 1b0f360..12d4f7a 100644 --- a/qemu-kvm.spec +++ b/qemu-kvm.spec @@ -92,7 +92,7 @@ Obsoletes: %1-rhev <= %{epoch}:%{version}-%{release} Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 6.2.0 -Release: 32%{?rcrel}%{anolis_release}%{?dist} +Release: 33%{?rcrel}%{anolis_release}%{?dist} # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped Epoch: 15 License: GPLv2 and GPLv2+ and CC-BY @@ -694,6 +694,8 @@ Patch1025: Add-loongarch-into-QEMU_ARCH_VIRTIO_PCI-to-support-q.patch Patch1026: Fix-host-architecture-macro-of-LoongArch-to-HOST_LOO.patch Patch1027: Fix-LoongArch-KVM-header-macros.patch Patch1028: Fixed-the-issue-where-qemu-specifies-the-boot-order.patch +# https://github.com/qemu/qemu/commit/10be627d2b5ec2d6b3dce045144aa739eef678b4 +Patch1029: 1029-anolis-qemu-fix-CVE-2023-3354.patch BuildRequires: wget BuildRequires: rpm-build @@ -1934,6 +1936,7 @@ sh %{_sysconfdir}/sysconfig/modules/kvm.modules &> /dev/null || : %changelog * Thu Aug 24 2023 lixianglai - 6.2.0-33.0.2 - loongarch: Fixed the issue where qemu specifies the boot order +- Fix CVE-2023-3354 (Liwei Ge ) * Tue Jun 27 2023 Jacob Wang - 6.2.0-32.0.1 - Adjust limit for virtiofsd minor version -- Gitee