File kvm-qemu-preXX-validate-virtqueue.patch of Package kvm

EMBARGOED CVE-2011-2212 qemu-kvm: virtqueue: too-large indirect descriptor buffer overflow

It was found that virtio subsystem in qemu-kvm did not properly validate
virtqueue in and out requests from the guest. A privileged guest user could use
this flaw to cause buffer overflow, causing the guest to crash (denial of
service) or, possibly, resulting in the privileged guest user escalating their
privileges on the host.

--

virtqueue_pop (and less importantly, virtqueue_avail_bytes) do not limit
the size of an indirect descriptor entry, which allows a guest to
specify an arbitrarily-long descriptor chain, which will overflow the
fixed-size arrays in VirtQueueElement, leading to memory corruption.

>From 8e16077bfcd2d06a98aec8348cc171402ed75b51 Mon Sep 17 00:00:00 2001
From: Nelson Elhage <nelhage@ksplice.com>
Date: Thu, 19 May 2011 13:23:17 -0400
Subject: [PATCH] virtqueue: Sanity-check the length of indirect descriptors.

We were previously allowing arbitrarily-long descriptors, which could lead to a
buffer overflow in the qemu-kvm process.
---
 hw/virtio.c |   10 ++++++++++
 1 files changed, 10 insertions(+), 0 deletions(-)

Index: qemu-kvm-0.12.5/hw/virtio.c
===================================================================
--- qemu-kvm-0.12.5.orig/hw/virtio.c
+++ qemu-kvm-0.12.5/hw/virtio.c
@@ -330,6 +330,11 @@ int virtqueue_avail_bytes(VirtQueue *vq,
             max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
             num_bufs = i = 0;
             desc_pa = vring_desc_addr(desc_pa, i);
+
+            if (max > VIRTQUEUE_MAX_SIZE) {
+                fprintf(stderr, "Too-large indirect descriptor");
+                exit(1);
+            }
         }
 
         do {
@@ -385,6 +390,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQue
         max = vring_desc_len(desc_pa, i) / sizeof(VRingDesc);
         desc_pa = vring_desc_addr(desc_pa, i);
         i = 0;
+
+        if (max > VIRTQUEUE_MAX_SIZE) {
+            fprintf(stderr, "Too-large indirect descriptor");
+            exit(1);
+        }
     }
 
     do {