All of lore.kernel.org
 help / color / mirror / Atom feed
* [Bug 1880822] [NEW] CVE-2020-13253 QEMU: sd: OOB access could crash the guest resulting in DoS
@ 2020-05-27  7:10 P J P
  2020-05-27  7:15 ` [Bug 1880822] " P J P
                   ` (6 more replies)
  0 siblings, 7 replies; 17+ messages in thread
From: P J P @ 2020-05-27  7:10 UTC (permalink / raw)
  To: qemu-devel

*** This bug is a security vulnerability ***

Public security bug reported:

An out-of-bounds read access issue was found in the SD Memory Card
emulator of the QEMU. It occurs while performing block write commands
via sdhci_write(), if a guest user has sent 'address' which is OOB of
's->wp_groups'. A guest user/process may use this flaw to crash the QEMU
process resulting in DoS.

** Affects: qemu
     Importance: Undecided
         Status: New


** Tags: cve qemu security

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-13253

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1880822

Title:
  CVE-2020-13253 QEMU: sd: OOB access could crash the guest resulting in
  DoS

Status in QEMU:
  New

Bug description:
  An out-of-bounds read access issue was found in the SD Memory Card
  emulator of the QEMU. It occurs while performing block write commands
  via sdhci_write(), if a guest user has sent 'address' which is OOB of
  's->wp_groups'. A guest user/process may use this flaw to crash the
  QEMU process resulting in DoS.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1880822/+subscriptions


^ permalink raw reply	[flat|nested] 17+ messages in thread
* [PATCH] hw/sd/sdcard: Verify CMD24 (Block Write) address is valid
@ 2020-06-04 17:34 ` Philippe Mathieu-Daudé
  0 siblings, 0 replies; 17+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-06-04 17:34 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Prasad J Pandit, Alexander Bulekov,
	Philippe Mathieu-Daudé,
	1880822, Paolo Bonzini, Philippe Mathieu-Daudé

Avoid OOB access by verifying the requested address belong to
the actual card size. Return ADDRESS_ERROR when not in range.

  "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"

  4.3.4 Data Write

  * Block Write

  Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
  occurred and no data transfer is performed.

Fixes: CVE-2020-13253
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
Cc: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/sd/sd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 3c06a0ac6d..0ced3b5e14 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1211,6 +1211,10 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
             /* Writing in SPI mode not implemented.  */
             if (sd->spi)
                 break;
+            if (addr >= sd->size) {
+                sd->card_status |= ADDRESS_ERROR;
+                return sd_r1;
+            }
             sd->state = sd_receivingdata_state;
             sd->data_start = addr;
             sd->data_offset = 0;
-- 
2.21.3



^ permalink raw reply related	[flat|nested] 17+ messages in thread
* [PATCH v2] hw/sd/sdcard: Verify CMD24 (Block Write) address is valid
@ 2020-06-04 18:25 ` Philippe Mathieu-Daudé
  0 siblings, 0 replies; 17+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-06-04 18:25 UTC (permalink / raw)
  To: qemu-devel
  Cc: Peter Maydell, Prasad J Pandit, qemu-block, 1880822,
	Philippe Mathieu-Daudé,
	Alexander Bulekov, Paolo Bonzini, Philippe Mathieu-Daudé

Avoid OOB access by verifying the requested address belong to
the actual card size. Return ADDRESS_ERROR when not in range.
Only move the state machine to ReceivingData if there is no
pending error.

  "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"

  4.3.4 Data Write

  * Block Write

  Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
  occurred and no data transfer is performed.

Fixes: CVE-2020-13253
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
Cc: Prasad J Pandit <pjp@fedoraproject.org>

v2: check for blksz in range, only go to sd_receivingdata_state
    if no error.
---
 hw/sd/sd.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 3c06a0ac6d..2254dc7acc 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1211,17 +1211,18 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
             /* Writing in SPI mode not implemented.  */
             if (sd->spi)
                 break;
-            sd->state = sd_receivingdata_state;
-            sd->data_start = addr;
-            sd->data_offset = 0;
-            sd->blk_written = 0;
-
-            if (sd->data_start + sd->blk_len > sd->size)
+            if (addr + sd->blk_len >= sd->size) {
                 sd->card_status |= ADDRESS_ERROR;
-            if (sd_wp_addr(sd, sd->data_start))
+            } else if (sd_wp_addr(sd, sd->data_start)) {
                 sd->card_status |= WP_VIOLATION;
-            if (sd->csd[14] & 0x30)
+            } else if (sd->csd[14] & 0x30) {
                 sd->card_status |= WP_VIOLATION;
+            } else {
+                sd->state = sd_receivingdata_state;
+                sd->data_start = addr;
+                sd->data_offset = 0;
+                sd->blk_written = 0;
+            }
             return sd_r1;
 
         default:
-- 
2.21.3



^ permalink raw reply related	[flat|nested] 17+ messages in thread
end of thread, other threads:[~2020-08-20 14:53 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-27  7:10 [Bug 1880822] [NEW] CVE-2020-13253 QEMU: sd: OOB access could crash the guest resulting in DoS P J P
2020-05-27  7:15 ` [Bug 1880822] " P J P
2020-05-27  7:18 ` P J P
2020-05-27  7:28 ` Philippe Mathieu-Daudé
2020-06-04 15:02 ` Philippe Mathieu-Daudé
2020-06-05 11:12 ` Philippe Mathieu-Daudé
2020-07-16 15:53 ` Philippe Mathieu-Daudé
2020-08-20 14:41 ` Thomas Huth
2020-06-04 17:34 [PATCH] hw/sd/sdcard: Verify CMD24 (Block Write) address is valid Philippe Mathieu-Daudé
2020-06-04 17:34 ` [Bug 1880822] " Philippe Mathieu-Daudé
2020-06-04 18:03 ` Paolo Bonzini
2020-06-04 18:20   ` Philippe Mathieu-Daudé
2020-06-04 18:20     ` [Bug 1880822] " Philippe Mathieu-Daudé
2020-06-04 18:25 [PATCH v2] " Philippe Mathieu-Daudé
2020-06-04 18:25 ` [Bug 1880822] " Philippe Mathieu-Daudé
2020-06-05  8:34 ` Philippe Mathieu-Daudé
2020-06-05  8:34   ` [Bug 1880822] " Philippe Mathieu-Daudé

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.