7872f3e77e
CVE-2013-4148 QEMU 1.0 integer conversion in
virtio_net_load()@hw/net/virtio-net.c
Deals with loading a corrupted savevm image.
> n->mac_table.in_use = qemu_get_be32(f);
in_use is int so it can get negative when assigned 32bit unsigned value.
> /* MAC_TABLE_ENTRIES may be different from the saved image */
> if (n->mac_table.in_use <= MAC_TABLE_ENTRIES) {
passing this check ^^^
> qemu_get_buffer(f, n->mac_table.macs,
> n->mac_table.in_use * ETH_ALEN);
with good in_use value, "n->mac_table.in_use * ETH_ALEN" can get
positive and bigger than mac_table.macs. For example 0x81000000
satisfies this condition when ETH_ALEN is 6.
Fix it by making the value unsigned.
For consistency, change first_multi as well.
Note: all call sites were audited to confirm that
making them unsigned didn't cause any issues:
it turns out we actually never do math on them,
so it's easy to validate because both values are
always <= MAC_TABLE_ENTRIES.
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| acpi | ||
| arm | ||
| audio | ||
| block | ||
| char | ||
| cpu | ||
| cris | ||
| i2c | ||
| i386 | ||
| input | ||
| intc | ||
| ipack | ||
| isa | ||
| kvm | ||
| lm32 | ||
| m68k | ||
| mips | ||
| misc | ||
| net | ||
| nvram | ||
| pci | ||
| pci-host | ||
| ppc | ||
| s390x | ||
| scsi | ||
| sh4 | ||
| sparc | ||
| timer | ||
| unicore32 | ||
| virtio | ||
| xen | ||
| boards.h | ||
| bt.h | ||
| devices.h | ||
| elf_ops.h | ||
| empty_slot.h | ||
| fw-path-provider.h | ||
| hotplug.h | ||
| hw.h | ||
| ide.h | ||
| irq.h | ||
| loader.h | ||
| pcmcia.h | ||
| ptimer.h | ||
| qdev-core.h | ||
| qdev-dma.h | ||
| qdev-properties.h | ||
| qdev.h | ||
| sd.h | ||
| ssi.h | ||
| stream.h | ||
| sysbus.h | ||
| usb.h | ||