[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 04/19] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [C
From: |
Paolo Bonzini |
Subject: |
[PULL 04/19] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] |
Date: |
Tue, 26 Sep 2023 18:59:00 +0200 |
From: Thomas Huth <thuth@redhat.com>
We are doing things like
nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
hw/scsi/scsi-disk.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index e0d79c7966c..477ee2bcd47 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq
*r, uint8_t *inbuf)
* Since the existing code only checks/updates bits 8-15 of the block
* size, restrict ourselves to the same requirement for now to ensure
* that a block size set by a block descriptor and then read back by
- * a subsequent SCSI command will be the same
+ * a subsequent SCSI command will be the same. Also disallow a block
+ * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE.
*/
- if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) {
+ if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) {
s->qdev.blocksize = bs;
trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize);
}
--
2.41.0
- [PULL 00/19] Misc patches for 2023-09-26, Paolo Bonzini, 2023/09/26
- [PULL 01/19] pc_piix: remove pc-i440fx-1.4 up to pc-i440fx-1.7, Paolo Bonzini, 2023/09/26
- [PULL 03/19] user-exec-stub: remove unused variable, Paolo Bonzini, 2023/09/26
- [PULL 04/19] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467],
Paolo Bonzini <=
- [PULL 07/19] ui/vnc: fix handling of VNC_FEATURE_XVP, Paolo Bonzini, 2023/09/26
- [PULL 06/19] ui/vnc: fix debug output for invalid audio message, Paolo Bonzini, 2023/09/26
- [PULL 12/19] target/i386/cpu: avoid shadowed local variables, Paolo Bonzini, 2023/09/26
- [PULL 08/19] mptsas: avoid shadowed local variables, Paolo Bonzini, 2023/09/26
- [PULL 10/19] m48t59-test: avoid possible overflow on ABS, Paolo Bonzini, 2023/09/26
- [PULL 17/19] block: mark mixed functions that can suspend, Paolo Bonzini, 2023/09/26
- [PULL 14/19] target/i386/seg_helper: introduce tss_set_busy, Paolo Bonzini, 2023/09/26
- [PULL 02/19] seabios: remove PCI drivers from bios.bin, Paolo Bonzini, 2023/09/26
- [PULL 15/19] target/i386/seg_helper: remove shadowed variable, Paolo Bonzini, 2023/09/26
- [PULL 05/19] vl: remove shadowed local variables, Paolo Bonzini, 2023/09/26