From 0a41cbff59a2353a2f39d80b3d4fffc5dc10081a Mon Sep 17 00:00:00 2001 From: Jinhao Gao Date: Mon, 28 Mar 2022 15:25:21 +0800 Subject: [PATCH 1/2] hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands This avoids an off-by-one read of 'mode_sense_valid' buffer in hw/scsi/scsi-disk.c:mode_sense_page(). Fixes: CVE-2021-3930 Cc: qemu-stable@nongnu.org Reported-by: Alexander Bulekov Fixes: a8f4bbe2900 ("scsi-disk: store valid mode pages in a table") Fixes: #546 Reported-by: Qiuhao Li Signed-off-by: Mauro Matteo Cascella Signed-off-by: Paolo Bonzini Signed-off-by: AlexChen Signed-off-by: yezengruan Signed-off-by: Jinhao Gao --- ...k-MODE_PAGE_ALLS-not-allowed-in-MODE.patch | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch diff --git a/hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch b/hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch new file mode 100644 index 0000000..1b0c29a --- /dev/null +++ b/hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch @@ -0,0 +1,50 @@ +From ea914867ecf5d342a7919abeff4b73c4a6f26e03 Mon Sep 17 00:00:00 2001 +From: AlexChen +Date: Thu, 4 Nov 2021 17:31:38 +0100 +Subject: [PATCH 2/2] hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE + SELECT commands + +This avoids an off-by-one read of 'mode_sense_valid' buffer in +hw/scsi/scsi-disk.c:mode_sense_page(). + +Fixes: CVE-2021-3930 +Cc: qemu-stable@nongnu.org +Reported-by: Alexander Bulekov +Fixes: a8f4bbe2900 ("scsi-disk: store valid mode pages in a table") +Fixes: #546 +Reported-by: Qiuhao Li +Signed-off-by: Mauro Matteo Cascella +Signed-off-by: Paolo Bonzini +cherry-pick from: b3af7fdf9cc537f8f0dd3e2423d83f5c99a457e8 +Signed-off-by: AlexChen +--- + hw/scsi/scsi-disk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c +index 93fdd913fe..9a67fc7dc6 100644 +--- a/hw/scsi/scsi-disk.c ++++ b/hw/scsi/scsi-disk.c +@@ -1089,6 +1089,7 @@ static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf, + uint8_t *p = *p_outbuf + 2; + int length; + ++ assert(page < ARRAY_SIZE(mode_sense_valid)); + if ((mode_sense_valid[page] & (1 << s->qdev.type)) == 0) { + return -1; + } +@@ -1430,6 +1431,11 @@ static int scsi_disk_check_mode_select(SCSIDiskState *s, int page, + return -1; + } + ++ /* MODE_PAGE_ALLS is only valid for MODE SENSE commands */ ++ if (page == MODE_PAGE_ALLS) { ++ return -1; ++ } ++ + p = mode_current; + memset(mode_current, 0, inlen + 2); + len = mode_sense_page(s, page, &p, 0); +-- +2.27.0 + -- Gitee From b7f9de338fa6efdef389eb5003c5966c571c5184 Mon Sep 17 00:00:00 2001 From: Jinhao Gao Date: Mon, 28 Mar 2022 15:53:20 +0800 Subject: [PATCH 2/2] spec: Update release version with !269 Signed-off-by: Jinhao Gao --- qemu.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/qemu.spec b/qemu.spec index 78fdcfc..6501708 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,6 +1,6 @@ Name: qemu Version: 4.1.0 -Release: 59 +Release: 60 Epoch: 2 Summary: QEMU is a generic and open source machine emulator and virtualizer License: GPLv2 and BSD and MIT and CC-BY-SA-4.0 @@ -309,6 +309,7 @@ Patch0296: upd6-check-udp6_input-buffer-size.patch Patch0297: tftp-check-tftp_input-buffer-size.patch Patch0298: tftp-introduce-a-header-structure.patch Patch0299: virtio-balloon-apply-upstream-patch.patch +Patch0300: hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch BuildRequires: flex BuildRequires: bison @@ -706,6 +707,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Mon Mar 28 2022 Jinhao Gao +- hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands(fix CVE-2021-3930) + * Fri Dec 03 2021 Chen Qun - virtio-balloon: apply upstream patch. -- Gitee