From 1ed0979cb8fecd995cb75bdaf3ad1a7d7890c1e7 Mon Sep 17 00:00:00 2001 From: yezengruan Date: Sat, 26 Mar 2022 19:49:44 +0800 Subject: [PATCH 1/2] hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands This avoids an off-by-one read of 'mode_sense_valid' buffer in hw/scsi/scsi-disk.c:mode_sense_page(). Fixes: CVE-2021-3930 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov Fixes: a8f4bbe2900 ("scsi-disk: store valid mode pages in a table") Fixes: #546 Reported-by: Qiuhao Li Signed-off-by: Mauro Matteo Cascella Signed-off-by: Paolo Bonzini Signed-off-by: AlexChen Signed-off-by: yezengruan --- ...k-MODE_PAGE_ALLS-not-allowed-in-MODE.patch | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch diff --git a/hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch b/hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch new file mode 100644 index 0000000..a4e5143 --- /dev/null +++ b/hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch @@ -0,0 +1,50 @@ +From 08438d7975713bbeed2dff8467bd4656b34221ad Mon Sep 17 00:00:00 2001 +From: AlexChen +Date: Thu, 4 Nov 2021 17:31:38 +0100 +Subject: [PATCH] hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT + commands + +This avoids an off-by-one read of 'mode_sense_valid' buffer in +hw/scsi/scsi-disk.c:mode_sense_page(). + +Fixes: CVE-2021-3930 +Cc: qemu-stable@nongnu.org +Reported-by: Alexander Bulekov +Fixes: a8f4bbe2900 ("scsi-disk: store valid mode pages in a table") +Fixes: #546 +Reported-by: Qiuhao Li +Signed-off-by: Mauro Matteo Cascella +Signed-off-by: Paolo Bonzini +cherry-pick from: b3af7fdf9cc537f8f0dd3e2423d83f5c99a457e8 +Signed-off-by: AlexChen +--- + hw/scsi/scsi-disk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c +index cd90cd780e..297efd5a72 100644 +--- a/hw/scsi/scsi-disk.c ++++ b/hw/scsi/scsi-disk.c +@@ -1082,6 +1082,7 @@ static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf, + uint8_t *p = *p_outbuf + 2; + int length; + ++ assert(page < ARRAY_SIZE(mode_sense_valid)); + if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) { + return -1; + } +@@ -1423,6 +1424,11 @@ static int scsi_disk_check_mode_select(SCSIDiskState *s, int page, + return -1; + } + ++ /* MODE_PAGE_ALLS is only valid for MODE SENSE commands */ ++ if (page == MODE_PAGE_ALLS) { ++ return -1; ++ } ++ + p = mode_current; + memset(mode_current, 0, inlen + 2); + len = mode_sense_page(s, page, &p, 0); +-- +2.27.0 + -- Gitee From 2881d06b3dfdc81704884a7d5224abd5c8ae311e Mon Sep 17 00:00:00 2001 From: yezengruan Date: Sat, 26 Mar 2022 19:51:44 +0800 Subject: [PATCH 2/2] spec: Update release version with !267 Signed-off-by: yezengruan --- qemu.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/qemu.spec b/qemu.spec index d3128cd..6a43ae4 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 51 +Release: 52 Epoch: 2 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY @@ -261,6 +261,7 @@ Patch0248: tftp-introduce-a-header-structure.patch Patch0249: fix-cve-2020-35504.patch Patch0250: fix-cve-2020-35505.patch Patch0251: virtio-balloon-apply-upstream-patch.patch +Patch0252: hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch BuildRequires: flex BuildRequires: bison @@ -606,6 +607,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Sat Mar 26 2022 yezengruan +- hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands(fix CVE-2021-3930) + * Fri Dec 03 2021 Chen Qun - virtio-balloon: apply upstream patch. -- Gitee