[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [qemu-xen master] uas: add stream number sanity checks.
commit 23ba9f170feca6ae0d8442aab2c89656f9b01288 Author: Gerd Hoffmann <kraxel@xxxxxxxxxx> AuthorDate: Wed Aug 18 14:05:05 2021 +0200 Commit: Michael Roth <michael.roth@xxxxxxx> CommitDate: Tue Dec 14 08:56:53 2021 -0600 uas: add stream number sanity checks. The device uses the guest-supplied stream number unchecked, which can lead to guest-triggered out-of-band access to the UASDevice->data3 and UASDevice->status3 fields. Add the missing checks. Fixes: CVE-2021-3713 Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx> Reported-by: Chen Zhe <chenzhe@xxxxxxxxxx> Reported-by: Tan Jingguo <tanjingguo@xxxxxxxxxx> Reviewed-by: Philippe Mathieu-Daudé <philmd@xxxxxxxxxx> Message-Id: <20210818120505.1258262-2-kraxel@xxxxxxxxxx> (cherry picked from commit 13b250b12ad3c59114a6a17d59caf073ce45b33a) Signed-off-by: Michael Roth <michael.roth@xxxxxxx> --- hw/usb/dev-uas.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c index 263056231c..f6309a5ebf 100644 --- a/hw/usb/dev-uas.c +++ b/hw/usb/dev-uas.c @@ -840,6 +840,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) } break; case UAS_PIPE_ID_STATUS: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { QTAILQ_FOREACH(st, &uas->results, next) { if (st->stream == p->stream) { @@ -867,6 +870,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) break; case UAS_PIPE_ID_DATA_IN: case UAS_PIPE_ID_DATA_OUT: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { req = usb_uas_find_request(uas, p->stream); } else { @@ -902,6 +908,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) p->status = USB_RET_STALL; break; } + +err_stream: + error_report("%s: invalid stream %d", __func__, p->stream); + p->status = USB_RET_STALL; + return; } static void usb_uas_unrealize(USBDevice *dev) -- generated by git-patchbot for /home/xen/git/qemu-xen.git#master
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |