All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mauro Matteo Cascella <mcascell@redhat.com>
To: "Philippe Mathieu-Daudé" <philmd@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>,
	Gerd Hoffmann <kraxel@redhat.com>,
	QEMU Developers <qemu-devel@nongnu.org>
Subject: Re: [PATCH 0/1] uas: add stream number sanity checks (maybe 6.1)
Date: Mon, 23 Aug 2021 11:59:07 +0200	[thread overview]
Message-ID: <CAA8xKjXQOKGAQ3Lkrw4TDWd1wPyUOCZ9PzPc_fdw2uC6S62eRg@mail.gmail.com> (raw)
In-Reply-To: <de938d0f-7de6-d34e-5f48-c4b6346545f4@redhat.com>

Hi,

On Fri, Aug 20, 2021 at 3:07 PM Philippe Mathieu-Daudé
<philmd@redhat.com> wrote:
>
> Cc'ing Mauro to double-check.
>
> On 8/20/21 2:12 PM, Peter Maydell wrote:
> > On Wed, 18 Aug 2021 at 13:10, Gerd Hoffmann <kraxel@redhat.com> wrote:
> >>
> >> Security fix.  Sorry for the last-minute patch, I had completely
> >> forgotten this one until the CVE number for it arrived today.
> >>
> >> Given that the classic usb storage device is way more popular than
> >> the uas (usb attached scsi) device the impact should be pretty low
> >> and we might consider to not screw up our release schedule for this.
> >
> > What's the impact if the bug is exploited ?
>
> Bug class: "guest-triggered user-after-free".
>
> Being privileged (root) in the guest, you can leak some data from
> the host process then DoS the host or potentially exploit the
> use-after-free to execute code on the host.
>

This is actually an out-of-bounds access issue (not UAF). It's still
potentially bad, but I agree with Gerd the impact is low. Plus there's
an assert right before [1] that makes it a DoS if the accessed memory
is not NULL.

[1] https://gitlab.com/qemu-project/qemu/-/blob/master/hw/usb/dev-uas.c#L850

Regards.
--
Mauro Matteo Cascella
Red Hat Product Security
PGP-Key ID: BB3410B0



  reply	other threads:[~2021-08-23 10:01 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-18 12:05 [PATCH 0/1] uas: add stream number sanity checks (maybe 6.1) Gerd Hoffmann
2021-08-18 12:05 ` [PATCH 1/1] uas: add stream number sanity checks Gerd Hoffmann
2021-08-18 15:12   ` Philippe Mathieu-Daudé
2021-12-09 20:16   ` Guenter Roeck
2021-08-20 11:24 ` [PATCH 0/1] uas: add stream number sanity checks (maybe 6.1) Philippe Mathieu-Daudé
2021-08-20 12:12 ` Peter Maydell
2021-08-20 13:07   ` Philippe Mathieu-Daudé
2021-08-23  9:59     ` Mauro Matteo Cascella [this message]
2021-08-23 10:18       ` Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAA8xKjXQOKGAQ3Lkrw4TDWd1wPyUOCZ9PzPc_fdw2uC6S62eRg@mail.gmail.com \
    --to=mcascell@redhat.com \
    --cc=kraxel@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=philmd@redhat.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.