From 13b250b12ad3c59114a6a17d59caf073ce45b33a Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 18 Aug 2021 14:05:05 +0200 Subject: [PATCH] uas: add stream number sanity checks. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The device uses the guest-supplied stream number unchecked, which can lead to guest-triggered out-of-band access to the UASDevice->data3 and UASDevice->status3 fields. Add the missing checks. Fixes: CVE-2021-3713 Signed-off-by: Gerd Hoffmann Reported-by: Chen Zhe Reported-by: Tan Jingguo Reviewed-by: Philippe Mathieu-Daudé Message-Id: <20210818120505.1258262-2-kraxel@redhat.com> --- hw/usb/dev-uas.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c index 263056231c..f6309a5ebf 100644 --- a/hw/usb/dev-uas.c +++ b/hw/usb/dev-uas.c @@ -840,6 +840,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) } break; case UAS_PIPE_ID_STATUS: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { QTAILQ_FOREACH(st, &uas->results, next) { if (st->stream == p->stream) { @@ -867,6 +870,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) break; case UAS_PIPE_ID_DATA_IN: case UAS_PIPE_ID_DATA_OUT: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { req = usb_uas_find_request(uas, p->stream); } else { @@ -902,6 +908,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) p->status = USB_RET_STALL; break; } + +err_stream: + error_report("%s: invalid stream %d", __func__, p->stream); + p->status = USB_RET_STALL; + return; } static void usb_uas_unrealize(USBDevice *dev)