OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

This net pull request contains security fixes for qemu.git/master. The patches

Browse Source 
should also be applied to stable trees.
 
 The ne2000 NIC model has QEMU memory corruption issue.  Both ne2000 and e1000
 have an infinite loop.
 
 Please see the patches for CVE numbers and details on the bugs.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJV+AjNAAoJEJykq7OBq3PI0ugH/05Q1o0CIB5pjFvxI4OiUyNU
 J32Q2RVaGETGBr3nIcfvw+rs49RN5r4Zt1qnNKe3siQ/wllPyBVMr5k0Oes3ZM4l
 JnmM8npYXA1peAKS/wCdLLCavf6Im7qQcvE6/3hrzqgjYwrkeDTXFnZYH1Crq4VX
 XbAQNO9aBbiJdyTWKbdu++FBZI1SdSvWH5KIMUTxFDlNQgpAF3BuCQJIBw0Z+b6F
 vCXdzgx5UvMBRpnTODF094ek51PfL1s919Z3BNlW2YQhR6agAOBaQjghL2ST1ptc
 DNkrkrpIDTcDTc9T/ZntuyPchbisvCrTR6fQnpHIEJ3bkTnWgEjiMazxQlwJHO0=
 =3FlB
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/stefanha/tags/net-pull-request' into staging

This net pull request contains security fixes for qemu.git/master.  The patches
should also be applied to stable trees.

The ne2000 NIC model has QEMU memory corruption issue.  Both ne2000 and e1000
have an infinite loop.

Please see the patches for CVE numbers and details on the bugs.

# gpg: Signature made Tue 15 Sep 2015 13:02:21 BST using RSA key ID 81AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"

* remotes/stefanha/tags/net-pull-request:
  net: avoid infinite loop when receiving packets(CVE-2015-5278)
  net: add checks to validate ring buffer pointers(CVE-2015-5279)
  e1000: Avoid infinite loop in processing transmit descriptor (CVE-2015-6815)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2015-09-15 13:03:53 +01:00
commit b76a0d5db2
2 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hw/net/e1000.c
View File

@ -740,7 +740,8 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
memmove(tp->data, tp->header, tp->hdr_len);
tp->size = tp->hdr_len;
}
} while (split_size -= bytes);
split_size -= bytes;
} while (bytes && split_size);
} else if (!tp->tse && tp->cptse) {
// context descriptor TSE is not set, while data descriptor TSE is set
DBGOUT(TXERR, "TCP segmentation error\n");

21
hw/net/ne2000.c
View File

@ -221,6 +221,9 @@ ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
}
index = s->curpag << 8;
if (index >= NE2000_PMEM_END) {
index = s->start;
}
/* 4 bytes for header */
total_len = size + 4;
/* address for next packet (4 bytes for CRC) */
@ -244,7 +247,7 @@ ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
if (index <= s->stop)
avail = s->stop - index;
else
avail = 0;
break;
len = size;
if (len > avail)
len = avail;
@ -306,13 +309,19 @@ static void ne2000_ioport_write(void *opaque, uint32_t addr, uint32_t val)
offset = addr | (page << 4);
switch(offset) {
case EN0_STARTPG:
s->start = val << 8;
if (val << 8 <= NE2000_PMEM_END) {
s->start = val << 8;
}
break;
case EN0_STOPPG:
s->stop = val << 8;
if (val << 8 <= NE2000_PMEM_END) {
s->stop = val << 8;
}
break;
case EN0_BOUNDARY:
s->boundary = val;
if (val << 8 < NE2000_PMEM_END) {
s->boundary = val;
}
break;
case EN0_IMR:
s->imr = val;
@ -353,7 +362,9 @@ static void ne2000_ioport_write(void *opaque, uint32_t addr, uint32_t val)
s->phys[offset - EN1_PHYS] = val;
break;
case EN1_CURPAG:
s->curpag = val;
if (val << 8 < NE2000_PMEM_END) {
s->curpag = val;
}
break;
case EN1_MULT ... EN1_MULT + 7:
s->mult[offset - EN1_MULT] = val;