oss-security - Re: CVE request: qemu-kvm: OOB memory access caused by negative vq notifies

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <667287819.1024512.1309377483164.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 29 Jun 2011 15:58:03 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: qemu-kvm: OOB memory access caused
 by negative vq notifies

Please use CVE-2011-2512.

Thanks.

-- 
    JB

----- Original Message -----
> The virtio_queue_notify() function checks that the virtqueue number is
> less than the maximum number of virtqueues. A signed comparison is
> used but the virtqueue number could be negative if a buggy or
> malicious
> guest is run. This results in memory accesses outside of the virtqueue
> array.
> 
> To trigger this issue the attacker needs to issue 32bit write to Queue
> Notify field of Virtio Header in the virtio pci config space even
> though
> the field is 16bit only by specs. Qemu-kvm allows that for the moment
> and provides whole 32bit value to the underlying functions.
> 
> Unprivileged guest user could use this flaw to crash the guest (denial
> of service) or, possibly, escalate their privileges on the host.
> 
> Upstream patch:
> http://patchwork.ozlabs.org/patch/94604/
> 
> References:
> https://bugzilla.redhat.com/show_bug.cgi?id=717399
> http://patchwork.ozlabs.org/patch/94604/
> 
> Thanks,
> --
> Petr Matousek / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.