diff --git a/hw-usb-core-fix-buffer-overflow.patch b/hw-usb-core-fix-buffer-overflow.patch new file mode 100644 index 0000000000000000000000000000000000000000..de5b804412f3f6ce86b057e5911e99aade3232c6 --- /dev/null +++ b/hw-usb-core-fix-buffer-overflow.patch @@ -0,0 +1,44 @@ +hw-usb-core-fix-buffer-overflow + +From 18ad0451f113ffc3a2ff59c059d189cca1e42842 Mon Sep 17 00:00:00 2001 +From: root +Date: Wed, 19 Aug 2020 17:04:04 +0800 +Subject: [PATCH] Store calculated setup_len in a local variable, verify it, + and only write it to the struct (USBDevice->setup_len) in case it passed the + sanity checks. + +This prevents other code (do_token_{in,out} function specifically) +from working with invalid USBDevice->setup_len values and overruning +the USBDevice->setup_buf[] buffer. +Store +Fixes: CVE-2020-14364 +Signed-off-by: Gred Hoffman +--- + hw/usb/core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/hw/usb/core.c b/hw/usb/core.c +index 5abd128b..12342f13 100644 +--- a/hw/usb/core.c ++++ b/hw/usb/core.c +@@ -144,6 +144,8 @@ static void do_token_setup(USBDevice *s, USBPacket *p) + "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", + s->setup_len, sizeof(s->data_buf)); + p->status = USB_RET_STALL; ++ s->setup_len = 0; ++ s->setup_state = SETUP_STATE_ACK; + return; + } + +@@ -277,6 +279,8 @@ static void do_parameter(USBDevice *s, USBPacket *p) + "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n", + s->setup_len, sizeof(s->data_buf)); + p->status = USB_RET_STALL; ++ s->setup_len = 0; ++ s->setup_state = SETUP_STATE_ACK; + return; + } + +-- +2.23.0 + diff --git a/qemu.spec b/qemu.spec index 2293b2d061fcb7bf6b503ab2f704220a4b8bf25a..4e763d101a673026572f9d6f59889fe67a4db174 100644 --- a/qemu.spec +++ b/qemu.spec @@ -204,6 +204,7 @@ Patch0191: test-tpm-pass-optional-machine-options-to-swtpm-test.patch Patch0192: test-tpm-tis-Get-prepared-to-share-tests-between-ISA.patch Patch0193: test-tpm-tis-Add-Sysbus-TPM-TIS-device-test.patch Patch0194: build-smt-processor-structure-to-support-smt-topolog.patch +Patch0195: hw-usb-core-fixe-buffer-overflow.patch BuildRequires: flex BuildRequires: bison @@ -550,6 +551,9 @@ getent passwd qemu >/dev/null || \ %endif %changelog +* Thu Aug 20 2020 Huawei Technologies Co., Ltd +- hw/usb.core.c: fix buffer overflowe in do_token_setup() function + * Tue Aug 18 2020 Huawei Technologies Co., Ltd - hw/acpi/aml-build.c: build smt processor structure to support smt topology