* [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196
@ 2021-11-17 23:24 Philippe Mathieu-Daudé
2021-11-17 23:24 ` [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 Philippe Mathieu-Daudé
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-11-17 23:24 UTC (permalink / raw)
To: qemu-devel
Cc: Kevin Wolf, Laurent Vivier, Thomas Huth, Prasad J Pandit,
qemu-block, Philippe Mathieu-Daudé,
Markus Armbruster, Alexander Bulekov, Hanna Reitz, Paolo Bonzini,
Gaoning Pan, John Snow
I'm not sure what happened to v1 from Prasad, so since we are
at rc2 I took a simpler approach to fix this CVE: create an
empty drive to satisfy the BlockBackend API calls.
Added Alexander's reproducer along.
v1: https://lore.kernel.org/qemu-devel/20210123100345.642933-1-ppandit@redhat.com/
Alexander Bulekov (1):
tests/qtest/fdc-test: Add a regression test for CVE-2021-20196
Philippe Mathieu-Daudé (1):
hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
hw/block/fdc.c | 14 +++++++++++++-
tests/qtest/fdc-test.c | 21 +++++++++++++++++++++
2 files changed, 34 insertions(+), 1 deletion(-)
--
2.31.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
2021-11-17 23:24 [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Philippe Mathieu-Daudé
@ 2021-11-17 23:24 ` Philippe Mathieu-Daudé
2021-11-18 10:44 ` Darren Kenny
2021-11-17 23:24 ` [PATCH-for-6.2 v2 2/2] tests/qtest/fdc-test: Add a regression test for CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-18 10:45 ` [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Darren Kenny
2 siblings, 1 reply; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-11-17 23:24 UTC (permalink / raw)
To: qemu-devel
Cc: Kevin Wolf, Laurent Vivier, Thomas Huth, Prasad J Pandit,
qemu-block, Philippe Mathieu-Daudé,
Markus Armbruster, Alexander Bulekov, Hanna Reitz, Paolo Bonzini,
Gaoning Pan, John Snow
Guest might select another drive on the bus by setting the
DRIVE_SEL bit of the DIGITAL OUTPUT REGISTER (DOR).
The current controller model doesn't expect a BlockBackend
to be NULL. A simple way to fix CVE-2021-20196 is to create
an empty BlockBackend when it is missing. All further
accesses will be safely handled, and the controller state
machines keep behaving correctly.
Fixes: CVE-2021-20196
Reported-by: Gaoning Pan (Ant Security Light-Year Lab) <pgn@zju.edu.cn>
BugLink: https://bugs.launchpad.net/qemu/+bug/1912780
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/338
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
hw/block/fdc.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index fa933cd3263..eab17e946d6 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -1161,7 +1161,19 @@ static FDrive *get_drv(FDCtrl *fdctrl, int unit)
static FDrive *get_cur_drv(FDCtrl *fdctrl)
{
- return get_drv(fdctrl, fdctrl->cur_drv);
+ FDrive *cur_drv = get_drv(fdctrl, fdctrl->cur_drv);
+
+ if (!cur_drv->blk) {
+ /*
+ * Kludge: empty drive line selected. Create an anonymous
+ * BlockBackend to avoid NULL deref with various BlockBackend
+ * API calls within this model (CVE-2021-20196).
+ * Due to the controller QOM model limitations, we don't
+ * attach the created to the controller.
+ */
+ cur_drv->blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
+ }
+ return cur_drv;
}
/* Status A register : 0x00 (read-only) */
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH-for-6.2 v2 2/2] tests/qtest/fdc-test: Add a regression test for CVE-2021-20196
2021-11-17 23:24 [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-17 23:24 ` [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 Philippe Mathieu-Daudé
@ 2021-11-17 23:24 ` Philippe Mathieu-Daudé
2021-11-18 10:45 ` [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Darren Kenny
2 siblings, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-11-17 23:24 UTC (permalink / raw)
To: qemu-devel
Cc: Kevin Wolf, Laurent Vivier, Thomas Huth, Prasad J Pandit,
qemu-block, Philippe Mathieu-Daudé,
Markus Armbruster, Alexander Bulekov, Hanna Reitz, Paolo Bonzini,
Gaoning Pan, John Snow
From: Alexander Bulekov <alxndr@bu.edu>
When running 'make check-qtest-i386' with QEMU configured
with '--enable-sanitizers' we get:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==287878==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000344
==287878==The signal is caused by a WRITE memory access.
==287878==Hint: address points to the zero page.
#0 0x564b2e5bac27 in blk_inc_in_flight block/block-backend.c:1346:5
#1 0x564b2e5bb228 in blk_pwritev_part block/block-backend.c:1317:5
#2 0x564b2e5bcd57 in blk_pwrite block/block-backend.c:1498:11
#3 0x564b2ca1cdd3 in fdctrl_write_data hw/block/fdc.c:2221:17
#4 0x564b2ca1b2f7 in fdctrl_write hw/block/fdc.c:829:9
#5 0x564b2dc49503 in portio_write softmmu/ioport.c:201:9
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210319050906.14875-2-alxndr@bu.edu>
[PMD: Rebased, use global test_image]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
tests/qtest/fdc-test.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/tests/qtest/fdc-test.c b/tests/qtest/fdc-test.c
index 26b69f7c5cd..dfca84c7b96 100644
--- a/tests/qtest/fdc-test.c
+++ b/tests/qtest/fdc-test.c
@@ -546,6 +546,26 @@ static void fuzz_registers(void)
}
}
+static void test_cve_2021_20196(void)
+{
+ QTestState *s;
+
+ s = qtest_initf("-nographic -m 32M -nodefaults "
+ "-drive file=%s,format=raw,if=floppy", test_image);
+ qtest_outw(s, 0x3f2, 0x0004);
+ qtest_outw(s, 0x3f4, 0x0200);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f4, 0x0000);
+ qtest_outw(s, 0x3f2, 0x0001);
+ qtest_quit(s);
+}
+
int main(int argc, char **argv)
{
int fd;
@@ -576,6 +596,7 @@ int main(int argc, char **argv)
qtest_add_func("/fdc/read_no_dma_18", test_read_no_dma_18);
qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19);
qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
+ qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196);
ret = g_test_run();
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
2021-11-17 23:24 ` [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 Philippe Mathieu-Daudé
@ 2021-11-18 10:44 ` Darren Kenny
2021-11-18 11:54 ` Philippe Mathieu-Daudé
0 siblings, 1 reply; 6+ messages in thread
From: Darren Kenny @ 2021-11-18 10:44 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, qemu-devel
Cc: Kevin Wolf, Laurent Vivier, Thomas Huth, Prasad J Pandit,
qemu-block, John Snow, Markus Armbruster, Alexander Bulekov,
Hanna Reitz, Paolo Bonzini, Gaoning Pan,
Philippe Mathieu-Daudé
Hi Philippe,
A small nit below, but otherwise looks good.
On Thursday, 2021-11-18 at 00:24:21 +01, Philippe Mathieu-Daudé wrote:
> Guest might select another drive on the bus by setting the
> DRIVE_SEL bit of the DIGITAL OUTPUT REGISTER (DOR).
> The current controller model doesn't expect a BlockBackend
> to be NULL. A simple way to fix CVE-2021-20196 is to create
> an empty BlockBackend when it is missing. All further
> accesses will be safely handled, and the controller state
> machines keep behaving correctly.
>
> Fixes: CVE-2021-20196
> Reported-by: Gaoning Pan (Ant Security Light-Year Lab) <pgn@zju.edu.cn>
> BugLink: https://bugs.launchpad.net/qemu/+bug/1912780
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/338
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> hw/block/fdc.c | 14 +++++++++++++-
> 1 file changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/hw/block/fdc.c b/hw/block/fdc.c
> index fa933cd3263..eab17e946d6 100644
> --- a/hw/block/fdc.c
> +++ b/hw/block/fdc.c
> @@ -1161,7 +1161,19 @@ static FDrive *get_drv(FDCtrl *fdctrl, int unit)
>
> static FDrive *get_cur_drv(FDCtrl *fdctrl)
> {
> - return get_drv(fdctrl, fdctrl->cur_drv);
> + FDrive *cur_drv = get_drv(fdctrl, fdctrl->cur_drv);
> +
> + if (!cur_drv->blk) {
> + /*
> + * Kludge: empty drive line selected. Create an anonymous
> + * BlockBackend to avoid NULL deref with various BlockBackend
> + * API calls within this model (CVE-2021-20196).
> + * Due to the controller QOM model limitations, we don't
> + * attach the created to the controller.
>
The created .... to the controller
Something is missing here, maybe 'device'?
Thanks,
Darren.
> + */
> + cur_drv->blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
> + }
> + return cur_drv;
> }
>
> /* Status A register : 0x00 (read-only) */
> --
> 2.31.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196
2021-11-17 23:24 [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-17 23:24 ` [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-17 23:24 ` [PATCH-for-6.2 v2 2/2] tests/qtest/fdc-test: Add a regression test for CVE-2021-20196 Philippe Mathieu-Daudé
@ 2021-11-18 10:45 ` Darren Kenny
2 siblings, 0 replies; 6+ messages in thread
From: Darren Kenny @ 2021-11-18 10:45 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, qemu-devel
Cc: Kevin Wolf, Laurent Vivier, Thomas Huth, Prasad J Pandit,
qemu-block, John Snow, Markus Armbruster, Alexander Bulekov,
Hanna Reitz, Paolo Bonzini, Gaoning Pan,
Philippe Mathieu-Daudé
Hi Philippe,
Apart from a nit on patch 1, all looks good, so:
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Thanks,
Darren.
On Thursday, 2021-11-18 at 00:24:20 +01, Philippe Mathieu-Daudé wrote:
> I'm not sure what happened to v1 from Prasad, so since we are
> at rc2 I took a simpler approach to fix this CVE: create an
> empty drive to satisfy the BlockBackend API calls.
>
> Added Alexander's reproducer along.
>
> v1: https://lore.kernel.org/qemu-devel/20210123100345.642933-1-ppandit@redhat.com/
>
> Alexander Bulekov (1):
> tests/qtest/fdc-test: Add a regression test for CVE-2021-20196
>
> Philippe Mathieu-Daudé (1):
> hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
>
> hw/block/fdc.c | 14 +++++++++++++-
> tests/qtest/fdc-test.c | 21 +++++++++++++++++++++
> 2 files changed, 34 insertions(+), 1 deletion(-)
>
> --
> 2.31.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196
2021-11-18 10:44 ` Darren Kenny
@ 2021-11-18 11:54 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 6+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-11-18 11:54 UTC (permalink / raw)
To: Darren Kenny, qemu-devel
Cc: Kevin Wolf, Laurent Vivier, Thomas Huth, Prasad J Pandit,
qemu-block, Markus Armbruster, Alexander Bulekov, Hanna Reitz,
Paolo Bonzini, Gaoning Pan, John Snow
On 11/18/21 11:44, Darren Kenny wrote:
> Hi Philippe,
>
> A small nit below, but otherwise looks good.
>
> On Thursday, 2021-11-18 at 00:24:21 +01, Philippe Mathieu-Daudé wrote:
>> Guest might select another drive on the bus by setting the
>> DRIVE_SEL bit of the DIGITAL OUTPUT REGISTER (DOR).
>> The current controller model doesn't expect a BlockBackend
>> to be NULL. A simple way to fix CVE-2021-20196 is to create
>> an empty BlockBackend when it is missing. All further
>> accesses will be safely handled, and the controller state
>> machines keep behaving correctly.
>>
>> Fixes: CVE-2021-20196
>> Reported-by: Gaoning Pan (Ant Security Light-Year Lab) <pgn@zju.edu.cn>
>> BugLink: https://bugs.launchpad.net/qemu/+bug/1912780
>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/338
>> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
>> ---
>> hw/block/fdc.c | 14 +++++++++++++-
>> 1 file changed, 13 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/block/fdc.c b/hw/block/fdc.c
>> index fa933cd3263..eab17e946d6 100644
>> --- a/hw/block/fdc.c
>> +++ b/hw/block/fdc.c
>> @@ -1161,7 +1161,19 @@ static FDrive *get_drv(FDCtrl *fdctrl, int unit)
>>
>> static FDrive *get_cur_drv(FDCtrl *fdctrl)
>> {
>> - return get_drv(fdctrl, fdctrl->cur_drv);
>> + FDrive *cur_drv = get_drv(fdctrl, fdctrl->cur_drv);
>> +
>> + if (!cur_drv->blk) {
>> + /*
>> + * Kludge: empty drive line selected. Create an anonymous
>> + * BlockBackend to avoid NULL deref with various BlockBackend
>> + * API calls within this model (CVE-2021-20196).
>> + * Due to the controller QOM model limitations, we don't
>> + * attach the created to the controller.
>>
> The created .... to the controller
>
> Something is missing here, maybe 'device'?
OK. I forgot to add Cc: qemu-stable@nongnu.org so will respin.
Thanks,
Phil.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-11-18 11:55 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-17 23:24 [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-17 23:24 ` [PATCH-for-6.2 v2 1/2] hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-18 10:44 ` Darren Kenny
2021-11-18 11:54 ` Philippe Mathieu-Daudé
2021-11-17 23:24 ` [PATCH-for-6.2 v2 2/2] tests/qtest/fdc-test: Add a regression test for CVE-2021-20196 Philippe Mathieu-Daudé
2021-11-18 10:45 ` [PATCH-for-6.2 v2 0/2] hw/block/fdc: Fix CVE-2021-20196 Darren Kenny
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.