| commit | 7cfcc79b0ab800959716738aff9419f53fc68c9c | |
| author | Thomas Huth <thuth@redhat.com> | |
| Mon, 25 Sep 2023 09:18:54 +0000 (25 11:18 +0200) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Mon, 25 Sep 2023 16:25:03 +0000 (25 18:25 +0200) | ||
| tree | 80b9942fef474cfab13846acd3c4b03fdcef2364 | treesnapshot (tar.gz zip) |
| parent | 8a9fc82bac139f8814ed6ae338381a3992eb414c | commitdiff |
hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
We are doing things like
nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
We are doing things like
nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| hw/scsi/scsi-disk.c | diffblobblamehistory |