| commit | bedd7e93d01961fcb16a97ae45d93acf357e11f6 | |
| author | Jason Wang <jasowang@redhat.com> | |
| Thu, 2 Sep 2021 05:44:12 +0000 (2 13:44 +0800) | ||
| committer | Jason Wang <jasowang@redhat.com> | |
| Fri, 17 Sep 2021 08:07:52 +0000 (17 16:07 +0800) | ||
| tree | 720259ddf32094dee2e3267552dd25c648426712 | treesnapshot (tar.gz zip) |
| parent | 080832e4f4801a28bd1170c49e61f6a0f5f05d03 | commitdiff |
virtio-net: fix use after unmap/free for sg
When mergeable buffer is enabled, we try to set the num_buffers after
the virtqueue elem has been unmapped. This will lead several issues,
E.g a use after free when the descriptor has an address which belongs
to the non direct access region. In this case we use bounce buffer
that is allocated during address_space_map() and freed during
address_space_unmap().
Fixing this by storing the elems temporarily in an array and delay the
unmap after we set the the num_buffers.
This addresses CVE-2021-3748.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: fbe78f4f55c6 ("virtio-net support")
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
When mergeable buffer is enabled, we try to set the num_buffers after
the virtqueue elem has been unmapped. This will lead several issues,
E.g a use after free when the descriptor has an address which belongs
to the non direct access region. In this case we use bounce buffer
that is allocated during address_space_map() and freed during
address_space_unmap().
Fixing this by storing the elems temporarily in an array and delay the
unmap after we set the the num_buffers.
This addresses CVE-2021-3748.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: fbe78f4f55c6 ("virtio-net support")
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
| hw/net/virtio-net.c | diffblobblamehistory |