haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
qemu-patch-raspberry4/block
History
Felipe Franciosi 693fd2acdf iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) 
When querying an iSCSI server for the provisioning status of blocks (via
GET LBA STATUS), Qemu only validates that the response descriptor zero's
LBA matches the one requested. Given the SCSI spec allows servers to
respond with the status of blocks beyond the end of the LUN, Qemu may
have its heap corrupted by clearing/setting too many bits at the end of
its allocmap for the LUN.

A malicious guest in control of the iSCSI server could carefully program
Qemu's heap (by selectively setting the bitmap) and then smash it.

This limits the number of bits that iscsi_co_block_status() will try to
update in the allocmap so it can't overflow the bitmap.

Fixes: CVE-2020-1711
Cc: qemu-stable@nongnu.org
Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com>
Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2020-01-27 17:19:53 +01:00
..
accounting.c block: add empty account cookie type 2019-10-10 10:56:18 +02:00
aio_task.c block: introduce aio task pool 2019-10-10 10:56:17 +02:00
backup-top.c block/backup: fix memory leak in bdrv_backup_top_append() 2020-01-27 17:19:53 +01:00
backup-top.h block: introduce backup-top filter driver 2019-10-10 10:56:18 +02:00
backup.c block/backup-top: Don't acquire context while dropping top 2020-01-27 17:19:53 +01:00
blkdebug.c blkdebug: Allow taking/unsharing permissions 2020-01-06 13:43:06 +01:00
blklogwrites.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
blkreplay.c block: implement bdrv_snapshot_goto for blkreplay 2019-10-14 17:12:48 +02:00
blkverify.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
block-backend.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
block-copy.c block/block-copy: fix s->copy_size for compressed cluster 2019-11-04 09:21:45 +01:00
bochs.c block: Use QEMU_IS_ALIGNED 2019-09-16 14:48:30 +02:00
cloop.c block: Use QEMU_IS_ALIGNED 2019-09-16 14:48:30 +02:00
commit.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
copy-on-read.c block/cor: Drop cor_co_truncate() 2019-10-28 11:59:51 +01:00
create.c block/create: Do not abort if a block driver is not available 2019-09-13 12:18:37 +02:00
crypto.c block: Let format drivers pass @exact 2019-10-28 12:05:30 +01:00
crypto.h Clean up ill-advised or unusual header guards 2019-05-13 08:58:55 +02:00
curl.c curl: Check curl_multi_add_handle()'s return code 2019-09-16 15:31:12 +02:00
dirty-bitmap.c bitmap: Enforce maximum bitmap name length 2019-11-18 16:01:34 -06:00
dmg-bz2.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
dmg-lzfse.c block: adding lzfse decompressing support as a module. 2018-12-14 11:52:40 +01:00
dmg.c block: Use QEMU_IS_ALIGNED 2019-09-16 14:48:30 +02:00
dmg.h Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
file-posix.c block/file-posix: Fix laio_init() error handling crash bug 2019-12-02 16:14:41 +01:00
file-win32.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
filter-compress.c block: introduce compress filter driver 2020-01-06 13:43:07 +01:00
gluster.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
io.c block: Add bdrv_co_get_self_request() 2019-11-04 09:32:51 +01:00
iscsi-opts.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
iscsi.c iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) 2020-01-27 17:19:53 +01:00
linux-aio.c linux-aio: increasing MAX_EVENTS to a larger hardcoded value 2020-01-13 16:41:45 +00:00
Makefile.objs block: introduce compress filter driver 2020-01-06 13:43:07 +01:00
mirror.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
nbd.c nbd: assert that Error** is not NULL in nbd_iter_channel_error 2019-12-18 08:43:19 +01:00
nfs.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
null.c replay: add BH oneshot event for block layer 2019-10-14 17:12:48 +02:00
nvme.c block/nvme: add support for discard 2019-10-28 11:34:35 +01:00
parallels.c Block patches for softfreeze: 2019-10-28 14:40:01 +00:00
parallels.h Clean up includes 2018-02-09 05:05:11 +01:00
qapi.c qapi: query-blockstat: add driver specific file-posix stats 2019-10-10 10:56:18 +02:00
qcow.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
qcow2-bitmap.c qcow2-bitmaps: fix qcow2_can_store_new_dirty_bitmap 2020-01-06 13:43:06 +01:00
qcow2-cache.c core: replace getpagesize() with qemu_real_host_page_size 2019-10-26 15:38:06 +02:00
qcow2-cluster.c qcow2: Limit total allocation range to INT_MAX 2019-10-14 17:12:48 +02:00
qcow2-refcount.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
qcow2-snapshot.c qcow2: Fix v3 snapshot table entry compliancy 2019-10-28 11:54:09 +01:00
qcow2-threads.c block/qcow2: refactor encryption code 2019-09-16 15:36:22 +02:00
qcow2.c qcow2: Allow writing compressed data of multiple clusters 2020-01-06 13:43:07 +01:00
qcow2.h qcow2: Fix QCOW2_COMPRESSED_SECTOR_MASK 2019-11-07 14:37:46 +01:00
qed-check.c block/qed: add missed coroutine_fn markers 2019-04-30 15:29:00 +02:00
qed-cluster.c qed: protect table cache with CoMutex 2017-07-17 11:34:11 +08:00
qed-l2-cache.c qed: protect table cache with CoMutex 2017-07-17 11:34:11 +08:00
qed-table.c block/qed: add missed coroutine_fn markers 2019-04-30 15:29:00 +02:00
qed.c block: Pass truncate exact=true where reasonable 2019-10-28 12:08:45 +01:00
qed.h block/qed: add missed coroutine_fn markers 2019-04-30 15:29:00 +02:00
quorum.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
raw-format.c block: Let format drivers pass @exact 2019-10-28 12:05:30 +01:00
rbd.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
replication.c block/backup: use backup-top instead of write notifiers 2019-10-10 10:56:18 +02:00
sheepdog.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
snapshot.c block/snapshot: rename Error ** parameter to more common errp 2019-12-18 08:43:19 +01:00
ssh.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
stream.c job: drop job_drain 2019-09-10 08:58:43 +02:00
throttle-groups.c throttle-groups: fix memory leak in throttle_group_set_limit: 2020-01-06 13:43:06 +01:00
throttle.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
trace-events block/nvme: add support for discard 2019-10-28 11:34:35 +01:00
vdi.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
vhdx-endian.c Include qemu-common.h exactly where needed 2019-06-12 13:20:20 +02:00
vhdx-log.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
vhdx.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
vhdx.h block/vhdx: Use IEC binary prefixes for size constants 2019-04-30 15:29:00 +02:00
vmdk.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
vpc.c block: Add @exact parameter to bdrv_co_truncate() 2019-10-28 12:00:07 +01:00
vvfat.c block: Use QEMU_IS_ALIGNED 2019-09-16 14:48:30 +02:00
vxhs.c replay: add BH oneshot event for block layer 2019-10-14 17:12:48 +02:00
win32-aio.c Include qemu/module.h where needed, drop it from qemu-common.h 2019-06-12 13:18:33 +02:00
write-threshold.c qapi: Drop qapi_event_send_FOO()'s Error ** argument 2018-08-28 18:21:38 +02:00