mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-21 03:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Add fix for CVE-2022-1050

Browse Source 
Add a fix queued upstream for the issue in this CVE:

"""
Guest driver might execute HW commands when shared buffers are not yet
allocated.
This might happen on purpose (malicious guest) or because some other
guest/host address mapping.
We need to protect againts such case.
"""

(From OE-Core rev: 1b8513c1abdcd6430f9311efd04d785488f79d7d)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Richard Purdie
2022-04-12 11:01:51 +01:00
parent dbe3a77e0d
commit d3544320ec
2 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/qemu/qemu.inc
View File

@@ -32,6 +32,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://0001-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \
file://0001-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch \
file://0002-virtio-net-fix-map-leaking-on-error-during-receive.patch \
file://pvrdma.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"

45
meta/recipes-devtools/qemu/qemu/pvrdma.patch Normal file
View File

@@ -0,0 +1,45 @@
hw/pvrdma: Protect against buggy or malicious guest driver
Guest driver might execute HW commands when shared buffers are not yet
allocated.
This might happen on purpose (malicious guest) or because some other
guest/host address mapping.
We need to protect againts such case.
Reported-by: Mauro Matteo Cascella <mcascell@redhat.com>
Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
CVE: CVE-2022-1050
Upstream-Status: Submitted [https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg05197.html]
Index: qemu-6.2.0/hw/rdma/vmw/pvrdma_cmd.c
===================================================================
--- qemu-6.2.0.orig/hw/rdma/vmw/pvrdma_cmd.c
+++ qemu-6.2.0/hw/rdma/vmw/pvrdma_cmd.c
@@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
dsr_info = &dev->dsr_info;
+ if (!dsr_info->dsr) {
+ /* Buggy or malicious guest driver */
+ rdma_error_report("Exec command without dsr, req or rsp buffers");
+ goto out;
+ }
+
if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
sizeof(struct cmd_handler)) {
rdma_error_report("Unsupported command");
Index: qemu-6.2.0/hw/rdma/vmw/pvrdma_main.c
===================================================================
--- qemu-6.2.0.orig/hw/rdma/vmw/pvrdma_main.c
+++ qemu-6.2.0/hw/rdma/vmw/pvrdma_main.c
@@ -249,7 +249,8 @@ static void init_dsr_dev_caps(PVRDMADev
{
struct pvrdma_device_shared_region *dsr;
- if (dev->dsr_info.dsr == NULL) {
+ if (!dev->dsr_info.dsr) {
+ /* Buggy or malicious guest driver */
rdma_error_report("Can't initialized DSR");
return;
}