From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.1 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3DB0DC433DB for ; Wed, 24 Mar 2021 17:29:48 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AAFE4619DC for ; Wed, 24 Mar 2021 17:29:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AAFE4619DC Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=amsat.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:40210 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lP7KE-0001ig-Kv for qemu-devel@archiver.kernel.org; Wed, 24 Mar 2021 13:29:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57150) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lP7JH-0001HS-B7 for qemu-devel@nongnu.org; Wed, 24 Mar 2021 13:28:47 -0400 Received: from mail-wr1-x433.google.com ([2a00:1450:4864:20::433]:34449) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lP7JF-0002Kn-AW for qemu-devel@nongnu.org; Wed, 24 Mar 2021 13:28:47 -0400 Received: by mail-wr1-x433.google.com with SMTP id j7so25286640wrd.1 for ; Wed, 24 Mar 2021 10:28:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=eCpzCnVJHHDu8Kyw0rgtYuPWkcvZmfLF+xpzO27ex34=; b=AnzvyMdlTwK29yraEcNbOoeRcYb/gUYR/5GPEBIslSR1/HxSFJ2+vDAwcZG1YIpt1f QAInQ1nkTPwCXexbuKNr5GPb2ZOIB6W1zIE15+8nLvflFKtF1Ibe4K+OuTCPkCI5x8I+ W9W0MXrheC7Q6aTFNxSaI+Mubei9DyxLmb7eK1FKyPB32zZNW757xiK90doOQhvCQjCJ Esfq8uQDe712CtR8oCWos2TpI1t+zua92UXUBtB9Iuu5PP0/fHGJKq29RhFlivB6j8li /+FZiQmu8OITkA+v9JjQtvTqUHxphknQ4xUCepsL2MASUFWkmt0W16TePx2pyUwZsJfU 5HvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:subject:to:references:cc:from:message-id :date:user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=eCpzCnVJHHDu8Kyw0rgtYuPWkcvZmfLF+xpzO27ex34=; b=SqL8eQJcTZKhxQGyVxd5JNr6cfbEkmOn/4M7y3PN9luWxtdg/vkfjhTrWPYqQZTTMw OaM8KAG4PYebkzwwY1DFTfDaUzVTxBz76js3ua0c36JEBDGKDk9e4MRw5Wrpb/HWyFJg +M3ogIbCB8bvMR32Pw7KfK6WVKIN5RptDcXpCuuu+X/4rAPIn/rKNTB92vuRacVaeBC7 fHbLe6wUshqOqe2YmA8kZl3e8GiUkZ9aJf/E9cIJwY0Zp79NsEIwIncTPTz7lWdg+D9Q 1FtvuFESvDeqioDEHokVpJNd5f+xh0dDIwOsG4DjhvKBXbTXPHcf8GrhXtop9+XXkSTi 96+Q== X-Gm-Message-State: AOAM5301hGF2+96x9HsrSIkaaz4TSRKGg/AcZadrC7TOEuSs9FyaFbFJ Kxqbt21NllMRJ8EpMT2ZUvM= X-Google-Smtp-Source: ABdhPJz497adVvznyffCgGRctXMdFXhMbE0ySici8aEGXWUH1i+oTDXBMmEOlvAWRT1K/tBHzZ5Ekg== X-Received: by 2002:a5d:4bce:: with SMTP id l14mr4663394wrt.99.1616606923800; Wed, 24 Mar 2021 10:28:43 -0700 (PDT) Received: from [192.168.1.36] (17.red-88-21-201.staticip.rima-tde.net. [88.21.201.17]) by smtp.gmail.com with ESMTPSA id d204sm3382788wmc.17.2021.03.24.10.28.42 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 24 Mar 2021 10:28:42 -0700 (PDT) Subject: Re: [Bug 1909247] Re: QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c To: Bug 1909247 <1909247@bugs.launchpad.net>, qemu-devel@nongnu.org References: <160882932286.4370.15587232403500958955.malonedeb@wampee.canonical.com> <161657946470.23746.4749601633753443746.malone@chaenomeles.canonical.com> <20210324155324.mfta6pfa573ms5vi@mozz.bu.edu> From: =?UTF-8?Q?Philippe_Mathieu-Daud=c3=a9?= Message-ID: <7cf68684-d214-38a2-4a92-87b381f06a5a@amsat.org> Date: Wed, 24 Mar 2021 18:28:41 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.8.0 MIME-Version: 1.0 In-Reply-To: <20210324155324.mfta6pfa573ms5vi@mozz.bu.edu> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Received-SPF: pass client-ip=2a00:1450:4864:20::433; envelope-from=philippe.mathieu.daude@gmail.com; helo=mail-wr1-x433.google.com X-Spam_score_int: -14 X-Spam_score: -1.5 X-Spam_bar: - X-Spam_report: (-1.5 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Cave-Ayland Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On 3/24/21 4:53 PM, Alexander Bulekov wrote: > Hi, > I can still trigger stack-overflows, heap-UAFs and heap-overflows in the > code, but Mark's patches fixed some of the issues. I didn't want to > flood the issue-tracker with further problems in this code, since it > isn't clear what the security expectations are for this device. Of > course it is only a matter of time until someone sends more reports to > qemu-security. I'd expect qemu-security to have a template "Thank you for your bug but this device is not within the 'security' boundary, we will forward your report to the community". > > Mark, do you want me to provide more reproducers for this device? Surely Mark prefers you provide bugfixes instead :D Phil. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EEF0C433DB for ; Wed, 24 Mar 2021 17:42:40 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A196261A1A for ; Wed, 24 Mar 2021 17:42:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A196261A1A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=bugs.launchpad.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:49992 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lP7Wg-0006Mv-NT for qemu-devel@archiver.kernel.org; Wed, 24 Mar 2021 13:42:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59170) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lP7Pt-00048V-OC for qemu-devel@nongnu.org; Wed, 24 Mar 2021 13:35:38 -0400 Received: from indium.canonical.com ([91.189.90.7]:42030) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lP7Pq-0006ZU-0r for qemu-devel@nongnu.org; Wed, 24 Mar 2021 13:35:37 -0400 Received: from loganberry.canonical.com ([91.189.90.37]) by indium.canonical.com with esmtp (Exim 4.86_2 #2 (Debian)) id 1lP7Pn-00046P-QW for ; Wed, 24 Mar 2021 17:35:31 +0000 Received: from loganberry.canonical.com (localhost [127.0.0.1]) by loganberry.canonical.com (Postfix) with ESMTP id C79942E8157 for ; Wed, 24 Mar 2021 17:35:31 +0000 (UTC) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Date: Wed, 24 Mar 2021 17:28:41 -0000 From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <1909247@bugs.launchpad.net> To: qemu-devel@nongnu.org X-Launchpad-Notification-Type: bug X-Launchpad-Bug: product=qemu; status=New; importance=Undecided; assignee=None; X-Launchpad-Bug-Tags: cve fuzzer qemu security X-Launchpad-Bug-Information-Type: Public Security X-Launchpad-Bug-Private: no X-Launchpad-Bug-Security-Vulnerability: yes X-Launchpad-Bug-Commenters: a1xndr mark-cave-ayland mauro-cascella philmd pjps X-Launchpad-Bug-Reporter: Mauro Matteo Cascella (mauro-cascella) X-Launchpad-Bug-Modifier: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9_=28philmd?= =?utf-8?q?=29?= References: <160882932286.4370.15587232403500958955.malonedeb@wampee.canonical.com> <161657946470.23746.4749601633753443746.malone@chaenomeles.canonical.com> <20210324155324.mfta6pfa573ms5vi@mozz.bu.edu> Message-ID: <7cf68684-d214-38a2-4a92-87b381f06a5a@amsat.org> Subject: Re: [Bug 1909247] Re: QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c X-Launchpad-Message-Rationale: Subscriber (QEMU) @qemu-devel-ml X-Launchpad-Message-For: qemu-devel-ml Precedence: bulk X-Generated-By: Launchpad (canonical.com); Revision="4446feb642ca86be4f6eceb855b408397dad6a50"; Instance="production" X-Launchpad-Hash: 03794e1ae4c809e4c3fe2cb097091dbd44778b46 Received-SPF: none client-ip=91.189.90.7; envelope-from=bounces@canonical.com; helo=indium.canonical.com X-Spam_score_int: -65 X-Spam_score: -6.6 X-Spam_bar: ------ X-Spam_report: (-6.6 / 5.0 requ) BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Bug 1909247 <1909247@bugs.launchpad.net> Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" Message-ID: <20210324172841.DTZKzw3ml3FBsdyE_OeQwt7-KREfSDUgquxQWXpQZLE@z> On 3/24/21 4:53 PM, Alexander Bulekov wrote: > Hi, > I can still trigger stack-overflows, heap-UAFs and heap-overflows in the > code, but Mark's patches fixed some of the issues. I didn't want to > flood the issue-tracker with further problems in this code, since it > isn't clear what the security expectations are for this device. Of > course it is only a matter of time until someone sends more reports to > qemu-security. I'd expect qemu-security to have a template "Thank you for your bug but this device is not within the 'security' boundary, we will forward your report to the community". > = > Mark, do you want me to provide more reproducers for this device? Surely Mark prefers you provide bugfixes instead :D Phil. -- = You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1909247 Title: QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c Status in QEMU: New Bug description: A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU. It could occur in the esp_do_dma() function in hw/scsi/esp.c while handling the 'Information Transfer' command (CMD_TI). A privileged guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process. This issue was reported by Cheolwoo Myung (Seoul National University). Original report: Using hypervisor fuzzer, hyfuzz, I found a use-after-free issue in am53c974 emulator of QEMU enabled ASan. It occurs while transferring information, as it does not check the buffer to be transferred. A malicious guest user/process could use this flaw to crash the QEMU process resulting in DoS scenario. To reproduce this issue, please run the QEMU with the following command line. # To enable ASan option, please set configuration with the following $ ./configure --target-list=3Di386-softmmu --disable-werror --enable-sani= tizers $ make # To reproduce this issue, please run the QEMU process with the following= command line $ ./qemu-system-i386 -m 512 -drive file=3D./hyfuzz.img,index=3D0,media=3D= disk,format=3Draw \ -device am53c974,id=3Dscsi -device scsi-hd,drive=3DSysDisk \ -drive id=3DSysDisk,if=3Dnone,file=3D./disk.img Please find attached the disk images to reproduce this issue. To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1909247/+subscriptions