OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
QEMU With E2K User Support
36,320 Commits 9 Branches 0 Tags 459 MiB
C 83.1%
C++ 6.3%
Python 3.2%
Dylan 2.8%
Shell 1.6%
Other 2.8%
38f3ef574b
Go to file
Kevin Wolf 38f3ef574b raw: Prohibit dangerous writes for probed images 
If the user neglects to specify the image format, QEMU probes the
image to guess it automatically, for convenience.

Relying on format probing is insecure for raw images (CVE-2008-2004).
If the guest writes a suitable header to the device, the next probe
will recognize a format chosen by the guest.  A malicious guest can
abuse this to gain access to host files, e.g. by crafting a QCOW2
header with backing file /etc/shadow.

Commit 1e72d3b (April 2008) provided -drive parameter format to let
users disable probing.  Commit f965509 (March 2009) extended QCOW2 to
optionally store the backing file format, to let users disable backing
file probing.  QED has had a flag to suppress probing since the
beginning (2010), set whenever a raw backing file is assigned.

All of these additions that allow to avoid format probing have to be
specified explicitly. The default still allows the attack.

In order to fix this, commit 79368c8 (July 2010) put probed raw images
in a restricted mode, in which they wouldn't be able to overwrite the
first few bytes of the image so that they would identify as a different
image. If a write to the first sector would write one of the signatures
of another driver, qemu would instead zero out the first four bytes.
This patch was later reverted in commit 8b33d9e (September 2010) because
it didn't get the handling of unaligned qiov members right.

Today's block layer that is based on coroutines and has qiov utility
functions makes it much easier to get this functionality right, so this
patch implements it.

The other differences of this patch to the old one are that it doesn't
silently write something different than the guest requested by zeroing
out some bytes (it fails the request instead) and that it doesn't
maintain a list of signatures in the raw driver (it calls the usual
probe function instead).

Note that this change doesn't introduce new breakage for false positive
cases where the guest legitimately writes data into the first sector
that matches the signatures of an image format (e.g. for nested virt):
These cases were broken before, only the failure mode changes from
corruption after the next restart (when the wrong format is probed) to
failing the problematic write request.

Also note that like in the original patch, the restrictions only apply
if the image format has been guessed by probing. Explicitly specifying a
format allows guests to write anything they like.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1416497234-29880-8-git-send-email-kwolf@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2014-12-10 10:31:13 +01:00
audio audio: Drop superfluous conditionals around g_free() 2014-06-13 12:34:54 +02:00
backends pci, pc, virtio, misc bugfixes 2014-09-18 20:02:01 +01:00
block raw: Prohibit dangerous writes for probed images 2014-12-10 10:31:13 +01:00
bsd-user bsd-user: Fix syscall format, add strace support for more syscalls 2014-06-11 00:25:06 +01:00
default-configs mips: Remove CONFIG_VT82C686 from non-Fulong configs 2014-11-07 11:15:49 +00:00
disas disas/mips.c: disassemble MSA instructions 2014-11-03 11:48:35 +00:00
docs Tracing docs fix configure option and description 2014-11-18 14:05:54 +00:00
dtc@bc895d6d09 dtc: add submodule 2013-04-18 13:50:53 +02:00
fpu softfloat: add functions corresponding to IEEE-2008 min/maxNumMag 2014-10-14 13:28:51 +01:00
fsdev virtfs-proxy-helper: fix call to accept 2014-04-28 08:55:32 +04:00
gdb-xml s390x/gdb: add the feature xml files for s390x 2014-09-01 09:45:19 +02:00
hw ahci: replace SATA FIS type magic numbers with constants 2014-12-10 10:31:12 +01:00
include raw: Prohibit dangerous writes for probed images 2014-12-10 10:31:13 +01:00
libcacard libcacard: fix resource leak 2014-11-14 12:15:40 +01:00
libdecnumber libdecnumber: Fix warnings from smatch (missing static, boolean operations) 2014-08-24 13:21:06 +04:00
linux-headers linux-headers: update to 3.18-rc5 2014-11-18 11:24:31 +00:00
linux-user linux-user: Fix up timer id handling 2014-11-11 08:13:09 +02:00
net net/socket: fix Uninitialized scalar variable 2014-11-21 10:50:54 +00:00
pc-bios Update OpenBIOS images 2014-11-15 13:01:44 +00:00
pixman@87eea99e44 pixman: update internal copy to pixman-0.32.6 2014-09-15 08:14:19 +02:00
po po: fix conflict with %.mo rule in rules.mak 2014-09-26 13:35:08 +02:00
qapi block/qapi: Add cache information to query-block 2014-12-10 10:31:09 +01:00
qga qga: fix false negative argument passing 2014-11-17 11:41:25 +01:00
qobject qjson: Drop trailing space for pretty formatting 2014-12-10 10:25:30 +01:00
qom qom/cpu: remove the unused CPU hot-plug notifier 2014-11-02 13:44:11 +02:00
roms Update OpenBIOS images 2014-11-15 13:01:44 +00:00
scripts Tracing: Fix simpletrace.py error on tcg enabled binary traces 2014-11-18 14:05:58 +00:00
slirp slirp: udp: fix NULL pointer dereference because of uninitialized socket 2014-09-23 19:15:05 +01:00
stubs block: Code motion to get rid of stubs/blockdev.c 2014-10-20 13:41:26 +02:00
sysconfigs/target
target-alpha target-alpha: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:21 +01:00
target-arm target-arm: handle address translations that start at level 3 2014-11-17 19:30:28 +00:00
target-cris target-cris/translate.c: fix out of bounds read 2014-11-17 13:59:23 +01:00
target-i386 apic: avoid getting out of halted state on masked PIC interrupts 2014-11-24 14:37:30 +01:00
target-lm32 gdbstub: Allow target CPUs to specify watchpoint STOP_BEFORE_ACCESS flag 2014-10-06 14:25:43 +01:00
target-m68k target-m68k: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:21 +01:00
target-microblaze target-microblaze: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:22 +01:00
target-mips target-mips: fix multiple TCG registers covering same data 2014-11-07 14:15:28 +00:00
target-moxie softmmu: introduce cpu_ldst.h 2014-06-05 16:10:33 +02:00
target-openrisc target-openrisc: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:22 +01:00
target-ppc target-ppc: Altivec's mtvscr Decodes Wrong Register 2014-11-20 14:52:01 +01:00
target-s390x s390x/kvm: Fix compile error 2014-11-26 12:11:27 +01:00
target-sh4 target-sh4: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:22 +01:00
target-sparc target-sparc: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:22 +01:00
target-tricore target-tricore: Add instructions of BO opcode format 2014-10-20 12:25:07 +01:00
target-unicore32 target-unicore32: Use cpu_exec_interrupt qom hook 2014-09-25 18:54:22 +01:00
target-xtensa target-xtensa: add missing window check for entry 2014-11-10 17:59:13 +03:00
tcg tcg/mips: fix store softmmu slow path 2014-11-02 13:30:00 +01:00
tests qtests: Specify image format explicitly 2014-12-10 10:31:12 +01:00
trace trace: [hmp] Reimplement "trace-event" and "info trace-events" using QMP 2014-09-26 09:34:38 +01:00
ui input: move input-send-event into experimental namespace 2014-11-25 17:03:31 +00:00
util memory: expose alignment used for allocating RAM as MemoryRegion API 2014-11-23 12:11:30 +02:00
.exrc
.gitignore trace: [tcg] Generate TCG tracing routines 2014-08-12 14:26:12 +01:00
.gitmodules PPC: Add u-boot firmware for e500 2014-06-16 13:24:35 +02:00
.mailmap Update mailmap 2013-09-05 09:40:31 -05:00
.travis.yml .travis.yml: remove "make check" from main matrix 2014-09-26 21:05:06 +04:00
accel.c accel: Create accel object when initializing machine 2014-10-09 15:36:14 +02:00
aio-posix.c AioContext: introduce aio_prepare 2014-08-29 10:46:58 +01:00
aio-win32.c aio-win32: avoid out-of-bounds access to the events array 2014-09-22 11:39:21 +01:00
arch_init.c migration: static variables will not be reset at second migration 2014-11-20 18:17:22 +05:30
async.c async: aio_context_new(): Handle event_notifier_init failure 2014-09-22 11:39:48 +01:00
balloon.c qapi event: convert BALLOON_CHANGE 2014-06-23 11:12:28 -04:00
block-migration.c block: Rename BlockDriverAIOCB* to BlockAIOCB* 2014-10-20 13:41:27 +02:00
block.c raw: Prohibit dangerous writes for probed images 2014-12-10 10:31:13 +01:00
blockdev-nbd.c nbd: Change external interface to BlockBackend 2014-12-10 10:31:12 +01:00
blockdev.c blockdev: acquire AioContext in change-backing-file 2014-12-10 10:25:30 +01:00
blockjob.c block: declare blockjobs and dataplane friends! 2014-11-03 11:41:49 +00:00
bootdevice.c bootindex: change fprintf to error_report 2014-10-15 10:46:01 +02:00
bt-host.c sysemu: avoid proliferation of include/ subdirectories 2013-04-15 18:19:25 +02:00
bt-vhci.c sysemu: avoid proliferation of include/ subdirectories 2013-04-15 18:19:25 +02:00
Changelog Use qemu-project.org domain name 2013-10-11 09:34:56 -07:00
CODING_STYLE CODING_STYLE: Section about conditional statement 2014-08-15 18:54:06 +04:00
configure seccomp: change configure to avoid arm 32 to break 2014-11-11 17:05:21 +01:00
COPYING
COPYING.LIB
coroutine-gthread.c glib-compat.h: add new thread API emulation on top of pre-2.31 API 2014-06-10 07:44:01 +02:00
coroutine-sigaltstack.c coroutine-sigaltstack: Change jmp_buf to sigjmp_buf 2014-11-11 11:07:55 +03:00
coroutine-ucontext.c Fix warnings suppressors to honor --disable-werror 2013-04-17 10:28:04 -05:00
coroutine-win32.c coroutine-win32.c: Add noinline attribute to work around gcc bug 2014-06-26 14:08:14 +01:00
cpu-exec.c cpu-exec: Do CPU_INTERRUPT_HALT unconditionally 2014-09-25 18:54:22 +01:00
cpus.c Introduce cpu_clean_all_dirty 2014-09-16 11:04:09 +02:00
cputlb.c implementing victim TLB for QEMU system emulated TLB 2014-09-01 17:43:06 +01:00
device_tree.c device_tree.c: dump all err mesages with error_report 2014-09-02 22:38:16 +04:00
device-hotplug.c blockdev: Eliminate drive_del() 2014-10-20 13:41:26 +02:00
disas.c monitor: QEMU Monitor Instruction Disassembly Incorrect for PowerPC LE Mode 2014-06-16 13:24:26 +02:00
dma-helpers.c hw: Convert from BlockDriverState to BlockBackend, mostly 2014-10-20 14:02:25 +02:00
dump.c dump: Fix dump-guest-memory termination and use-after-close 2014-11-02 10:04:34 +03:00
exec.c memory: expose alignment used for allocating RAM as MemoryRegion API 2014-11-23 12:11:30 +02:00
gdbstub.c gdbstub: Add a missing case of signal number translation in gdbstub 2014-11-11 08:58:30 +03:00
HACKING HACKING: Document vaddr type usage 2013-07-23 02:41:31 +02:00
hmp-commands.hx hmp: Remove "info pcmcia" 2014-10-24 12:19:11 +01:00
hmp.c block/hmp: Allow node-name in 'info block' 2014-12-10 10:31:11 +01:00
hmp.h Add HMP command "info memory-devices" 2014-09-26 13:37:06 -04:00
iohandler.c iohandler.c: Properly initialize sigaction struct 2014-05-24 00:07:29 +04:00
ioport.c memory: convert memory_region_destroy to object_unparent 2014-08-18 12:06:20 +02:00
iothread.c async: aio_context_new(): Handle event_notifier_init failure 2014-09-22 11:39:48 +01:00
kvm-all.c pc: kvm: check if KVM has free memory slots to avoid abort() 2014-11-23 12:11:29 +02:00
kvm-stub.c pc: kvm: check if KVM has free memory slots to avoid abort() 2014-11-23 12:11:29 +02:00
LICENSE LICENSE: clarify 2013-08-12 09:15:12 -05:00
main-loop.c Revert "main-loop.c: Handle SIGINT, SIGHUP and SIGTERM synchronously" 2014-10-27 15:05:09 +00:00
MAINTAINERS Add Migration maintainer 2014-11-11 09:46:46 +01:00
Makefile trace: install trace-events file 2014-09-26 09:34:39 +01:00
Makefile.objs qemu-file: Move stdio implementation to qemu-file-stdio.c 2014-10-14 10:29:28 +02:00
Makefile.target bootdevice: move bootdevice related code to new file bootdevice.c 2014-10-15 09:49:48 +02:00
memory_mapping.c Add skip_dump flag to ignore memory region during dump 2014-10-31 11:29:01 +01:00
memory.c memory: expose alignment used for allocating RAM as MemoryRegion API 2014-11-23 12:11:30 +02:00
migration-exec.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
migration-fd.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
migration-rdma.c rdma: Fix incorrect description in comments 2014-09-20 17:55:53 +04:00
migration-tcp.c qemu-sockets: Add error to non-blocking connect handler 2014-10-09 15:36:15 +02:00
migration-unix.c qemu-sockets: Add error to non-blocking connect handler 2014-10-09 15:36:15 +02:00
migration.c block/migration: Disable cache invalidate for incoming migration 2014-10-14 09:35:21 +02:00
module-common.c module: implement module loading 2014-02-20 13:14:18 +01:00
monitor.c monitor: Fix HMP tab completion 2014-12-10 10:31:11 +01:00
nbd.c nbd: Use BlockBackend internally 2014-12-10 10:31:12 +01:00
numa.c numa: make 'info numa' take into account hotplugged memory 2014-11-11 08:50:58 +03:00
os-posix.c os-posix: reorder parent notification for -daemonize 2014-11-02 10:04:34 +03:00
os-win32.c pidfile: stop making pidfile error a special case 2014-11-02 10:04:34 +03:00
page_cache.c migration: Plug memory leak in migrate-set-cache-size command 2014-06-10 19:54:43 +04:00
qapi-schema.json input: move input-send-event into experimental namespace 2014-11-25 17:03:31 +00:00
qdev-monitor.c qdev: Use qdev_get_device_class() for -device <type>,help 2014-11-04 17:50:00 +01:00
qdict-test-data.txt
qemu-bridge-helper.c qemu-bridge-helper: Fix fd leak in main() 2014-06-27 10:39:10 +02:00
qemu-char.c qemu-char: fix tcp_get_fds 2014-11-23 12:11:29 +02:00
qemu-coroutine-io.c qemu-coroutine-io: fix for Win32 2014-08-29 10:46:58 +01:00
qemu-coroutine-lock.c coroutine: remove qemu_co_queue_wait_insert_head 2013-12-02 17:11:49 +01:00
qemu-coroutine-sleep.c coroutine: Drop co_sleep_ns 2014-08-29 10:46:58 +01:00
qemu-coroutine.c coroutine: make pool size dynamic 2014-08-15 15:07:14 +02:00
qemu-doc.texi qemu-doc.texi: fix typos in x509 examples 2014-11-05 09:53:18 +03:00
qemu-file-stdio.c qemu-file: Move stdio implementation to qemu-file-stdio.c 2014-10-14 10:29:28 +02:00
qemu-file-unix.c qemu-file: Move unix and socket implementations to qemu-file-unix.c 2014-10-14 10:29:28 +02:00
qemu-file.c qemu-file: Move stdio implementation to qemu-file-stdio.c 2014-10-14 10:29:28 +02:00
qemu-img-cmds.hx qemu-img: Add progress output for amend 2014-11-03 11:41:48 +00:00
qemu-img.c qemu-img: Omit error_report() after img_open() 2014-11-06 12:45:47 +01:00
qemu-img.texi qemu-img: Add progress output for amend 2014-11-03 11:41:48 +00:00
qemu-io-cmds.c qemu-io: Respect early image end for map 2014-10-23 15:34:02 +02:00
qemu-io.c qemu-io: Allow explicitly specifying format 2014-12-10 10:31:12 +01:00
qemu-log.c qemu-log: default to stderr for logging output 2013-02-26 13:31:47 -06:00
qemu-nbd.c qemu-nbd: Use BlockBackend where reasonable 2014-12-10 10:31:12 +01:00
qemu-nbd.texi nbd: Miscellaneous typo fixes. 2014-05-24 00:07:29 +04:00
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx chardev: Add -qmp-pretty 2014-12-10 10:25:30 +01:00
qemu-seccomp.c seccomp: whitelist syscalls fallocate(), fadvise64(), inotify_init1() and inotify_add_watch() 2014-11-11 17:01:35 +01:00
qemu-tech.texi qemu-tech.texi: update implemented xtensa features list 2012-11-29 13:00:52 -06:00
qemu-timer.c qemu-timer: Avoid overflows when converting timeout to struct timespec 2014-11-27 11:31:58 +00:00
qemu.nsi nsis: Improved support for parallel installation of 32 and 64 bit code 2013-11-07 07:02:44 +01:00
qemu.sasl sasl: Avoid 'Could not find keytab file' in syslog 2014-03-15 13:54:18 +04:00
qmp-commands.hx qmp: Add optional switch "query-nodes" in query-blockstats 2014-12-10 10:25:29 +01:00
qmp.c qmp: Print descriptions of object properties 2014-10-15 05:03:15 +02:00
qtest.c qtest: fix qtest log fd should be initialized before qtest chardev 2014-10-23 16:41:27 +02:00
README Use qemu-project.org domain name 2013-10-11 09:34:56 -07:00
rules.mak rules.mak: Allow .mo-objs and .mo-cflags in -y variables 2014-10-31 11:26:25 +01:00
savevm.c snapshot: Reset err to NULL to avoid double free 2014-11-03 09:48:41 +00:00
softmmu_template.h softmmu: provide softmmu access type enum 2014-11-03 11:48:34 +00:00
spice-qemu-char.c qemu-char: Rename register_char_driver_qapi() to register_char_driver() 2014-09-16 23:36:32 +01:00
tcg-runtime.c tcg: Push tcg-runtime routines into exec/helper-* 2014-05-28 09:33:54 -07:00
tci.c Merge remote-tracking branch 'remotes/bonzini/softmmu-smap' into staging 2014-06-05 21:06:14 +01:00
thread-pool.c block: Rename BlockDriverCompletionFunc to BlockCompletionFunc 2014-10-20 13:41:27 +02:00
thunk.c exec: move include files to include/exec/ 2012-12-19 08:31:31 +01:00
tpm.c Use error_is_set() only when necessary 2014-02-17 11:57:23 -05:00
trace-events megasas: Fixup MSI-X handling 2014-10-31 11:29:01 +01:00
translate-all.c translate-all.c: memory walker initial address miscalculation 2014-10-06 21:53:35 +03:00
translate-all.h translate-all: Change tb_check_watchpoint() argument to CPUState 2014-03-13 19:20:48 +01:00
user-exec.c softmmu: introduce cpu_ldst.h 2014-06-05 16:10:33 +02:00
VERSION Open 2.3 development tree 2014-12-09 21:48:34 +00:00
version.rc Use qemu-project.org domain name 2013-10-11 09:34:56 -07:00
vl.c chardev: Add -qmp-pretty 2014-12-10 10:25:30 +01:00
vmstate.c vmstate: Allow dynamic allocation for VBUFFER during migration 2014-10-14 09:35:48 +02:00
xbzrle.c xbzrle.c: Avoid undefined behaviour with signed arithmetic 2014-04-18 10:33:36 +04:00
xen-common-stub.c accel: Move Xen registration code to xen-common.c 2014-10-04 08:59:15 +02:00
xen-common.c accel: Pass MachineState object to accel init functions 2014-10-09 12:57:10 +02:00
xen-hvm-stub.c xen-hvm: Fix xen_hvm_init() to adjust pc memory layout 2014-06-23 17:50:04 +03:00
xen-hvm.c xen-hvm: Remove redundant variable 'xstate' 2014-11-11 17:34:53 +03:00
xen-mapcache.c xen: build on ARM 2014-07-07 10:37:40 +00:00

README 

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team