From 795b6dccd33e86db5f468bd502d59d4f0030ea51 Mon Sep 17 00:00:00 2001 From: "Huawei Technologies Co., Ltd" Date: Wed, 18 Nov 2020 10:22:32 +0800 Subject: [PATCH 1/3] ati: check x y display parameter values fix CVE-2020-24352 The source and destination x,y display parameters in ati_2d_blt() may run off the vga limits if either of s->regs.[src|dst]_[xy] is zero. Check the parameter values to avoid potential crash. Reported-by: Gaoning Pan Signed-off-by: Prasad J Pandit Message-id: 20201021103818.1704030-1-ppandit@redhat.com Signed-off-by: Gerd Hoffmann cherry-pick from commit ca1f9cbfdce4d63b10d57de80fef89a89d92a540 Signed-off-by: Jiajie Li --- ati-check-x-y-display-parameter-values.patch | 53 ++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 ati-check-x-y-display-parameter-values.patch diff --git a/ati-check-x-y-display-parameter-values.patch b/ati-check-x-y-display-parameter-values.patch new file mode 100644 index 00000000..43f9e720 --- /dev/null +++ b/ati-check-x-y-display-parameter-values.patch @@ -0,0 +1,53 @@ +From e80d8d7f805e07ba6f012423739e83553ea024ef Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Wed, 18 Nov 2020 10:22:32 +0800 +Subject: [PATCH] ati: check x y display parameter values + +fix CVE-2020-24352 + +The source and destination x,y display parameters in ati_2d_blt() +may run off the vga limits if either of s->regs.[src|dst]_[xy] is +zero. Check the parameter values to avoid potential crash. + +Reported-by: Gaoning Pan +Signed-off-by: Prasad J Pandit +Message-id: 20201021103818.1704030-1-ppandit@redhat.com +Signed-off-by: Gerd Hoffmann + +cherry-pick from commit ca1f9cbfdce4d63b10d57de80fef89a89d92a540 +Signed-off-by: Jiajie Li +--- + hw/display/ati_2d.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c +index 23a8ae0cd8..4dc10ea795 100644 +--- a/hw/display/ati_2d.c ++++ b/hw/display/ati_2d.c +@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s) + dst_stride *= bpp; + } + uint8_t *end = s->vga.vram_ptr + s->vga.vram_size; +- if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) * +- dst_stride >= end) { ++ if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end ++ || dst_bits + dst_x ++ + (dst_y + s->regs.dst_height) * dst_stride >= end) { + qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n"); + return; + } +@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s) + src_bits += s->regs.crtc_offset & 0x07ffffff; + src_stride *= bpp; + } +- if (src_bits >= end || src_bits + src_x + +- (src_y + s->regs.dst_height) * src_stride >= end) { ++ if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end ++ || src_bits + src_x ++ + (src_y + s->regs.dst_height) * src_stride >= end) { + qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n"); + return; + } +-- +2.27.0 + -- Gitee From 30bfe7795a3f40d84954d3b0a0b03d447c561643 Mon Sep 17 00:00:00 2001 From: Euler Robot Date: Sun, 22 Nov 2020 21:27:09 +0800 Subject: [PATCH 2/3] spec: Update patch and changelog with !32 ati: check x y display parameter values Signed-off-by: Alex Chen --- qemu.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/qemu.spec b/qemu.spec index 699a553b..ae047eb5 100644 --- a/qemu.spec +++ b/qemu.spec @@ -222,6 +222,7 @@ Patch0209: target-arm-ignore-evtstrm-and-cpuid-CPU-features.patch Patch0210: target-arm-Update-the-ID-registers-of-Kunpeng-920.patch Patch0211: target-arm-only-set-ID_PFR1_EL1.GIC-for-AArch32-gues.patch Patch0212: target-arm-clear-EL2-and-EL3-only-when-kvm-is-not-en.patch +Patch0213: ati-check-x-y-display-parameter-values.patch BuildRequires: flex BuildRequires: bison @@ -567,6 +568,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Wed Nov 18 2020 Huawei Technologies Co., Ltd +- ati: check x y display parameter values + * Mon Sep 21 2020 Huawei Technologies Co., Ltd - target/arm: Add isar_feature tests for PAN + ATS1E1 - target/arm: Add ID_AA64MMFR2_EL1 -- Gitee From 98759269c4cd9d71abc26b30b0474b63b0b85dc1 Mon Sep 17 00:00:00 2001 From: Euler Robot Date: Sun, 22 Nov 2020 21:27:10 +0800 Subject: [PATCH 3/3] spec: Update release version with !32 increase release verison by one Signed-off-by: Euler Robot --- qemu.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu.spec b/qemu.spec index ae047eb5..2cc2ec78 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 24 +Release: 25 Epoch: 2 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY -- Gitee