[{"id":1766363,"web_url":"http://patchwork.ozlabs.org/comment/1766363/","msgid":"<2eae1293-6aec-e387-4bfd-940936894cdd@redhat.com>","list_archive_url":null,"date":"2017-09-11T15:31:34","subject":"Re: [Qemu-devel] [PATCH v1] multiboot: validate multiboot header\n\taddress values","submitter":{"id":2701,"url":"http://patchwork.ozlabs.org/api/people/2701/","name":"Paolo Bonzini","email":"pbonzini@redhat.com"},"content":"On 07/09/2017 08:32, P J P wrote:\n> From: Prasad J Pandit \n> \n> While loading kernel via multiboot-v1 image, (flags & 0x00010000)\n> indicates that multiboot header contains valid addresses to load\n> the kernel image. These addresses are used to compute kernel\n> size and kernel text offset in the OS image. Validate these\n> address values to avoid an OOB access issue.\n> \n> This is CVE-2017-14167.\n> \n> Reported-by: Thomas Garnier \n> Signed-off-by: Prasad J Pandit \n> ---\n> hw/i386/multiboot.c | 19 +++++++++++++++++++\n> 1 file changed, 19 insertions(+)\n> \n> Update: add CVE-ID to the commit message.\n> \n> diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c\n> index 6001f4caa2..c7b70c91d5 100644\n> --- a/hw/i386/multiboot.c\n> +++ b/hw/i386/multiboot.c\n> @@ -221,15 +221,34 @@ int load_multiboot(FWCfgState *fw_cfg,\n> uint32_t mh_header_addr = ldl_p(header+i+12);\n> uint32_t mh_load_end_addr = ldl_p(header+i+20);\n> uint32_t mh_bss_end_addr = ldl_p(header+i+24);\n> +\n> mh_load_addr = ldl_p(header+i+16);\n> + if (mh_header_addr < mh_load_addr) {\n> + fprintf(stderr, \"invalid mh_load_addr address\\n\");\n> + exit(1);\n> + }\n> +\n> uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);\n> uint32_t mb_load_size = 0;\n> mh_entry_addr = ldl_p(header+i+28);\n> \n> if (mh_load_end_addr) {\n> + if (mh_bss_end_addr < mh_load_addr) {\n> + fprintf(stderr, \"invalid mh_bss_end_addr address\\n\");\n> + exit(1);\n> + }\n> mb_kernel_size = mh_bss_end_addr - mh_load_addr;\n> +\n> + if (mh_load_end_addr < mh_load_addr) {\n> + fprintf(stderr, \"invalid mh_load_end_addr address\\n\");\n> + exit(1);\n> + }\n> mb_load_size = mh_load_end_addr - mh_load_addr;\n> } else {\n> + if (kernel_file_size < mb_kernel_text_offset) {\n> + fprintf(stderr, \"invalid kernel_file_size\\n\");\n> + exit(1);\n> + }\n> mb_kernel_size = kernel_file_size - mb_kernel_text_offset;\n> mb_load_size = mb_kernel_size;\n> }\n> \n\nQueued, thanks.\n\nPaolo","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=nongnu.org\n\t(client-ip=2001:4830:134:3::11; helo=lists.gnu.org;\n\tenvelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n\treceiver=)","ext-mx07.extmail.prod.ext.phx2.redhat.com;\n\tdmarc=none (p=none dis=none) header.from=redhat.com","ext-mx07.extmail.prod.ext.phx2.redhat.com;\n\tspf=fail smtp.mailfrom=pbonzini@redhat.com"],"Received":["from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11])\n\t(using TLSv1 with cipher AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xrXBS6ZbBz9s7C\n\tfor ;\n\tTue, 12 Sep 2017 01:38:08 +1000 (AEST)","from localhost ([::1]:58472 helo=lists.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.71) (envelope-from\n\t)\n\tid 1drQml-0000pM-0V\n\tfor incoming@patchwork.ozlabs.org; Mon, 11 Sep 2017 11:38:07 -0400","from eggs.gnu.org ([2001:4830:134:3::10]:52591)\n\tby lists.gnu.org with esmtp (Exim 4.71)\n\t(envelope-from ) id 1drQgc-0004SS-Gh\n\tfor qemu-devel@nongnu.org; Mon, 11 Sep 2017 11:31:47 -0400","from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)\n\t(envelope-from ) id 1drQgY-0007eX-73\n\tfor qemu-devel@nongnu.org; Mon, 11 Sep 2017 11:31:46 -0400","from mx1.redhat.com ([209.132.183.28]:46098)\n\tby eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)\n\t(Exim 4.71) (envelope-from ) id 1drQgY-0007ce-1F\n\tfor qemu-devel@nongnu.org; Mon, 11 Sep 2017 11:31:42 -0400","from smtp.corp.redhat.com\n\t(int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15])\n\t(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby mx1.redhat.com (Postfix) with ESMTPS id 2387AC0A524C;\n\tMon, 11 Sep 2017 15:31:41 +0000 (UTC)","from [10.36.117.6] (ovpn-117-6.ams2.redhat.com [10.36.117.6])\n\tby smtp.corp.redhat.com (Postfix) with ESMTPS id 1EEB56B275;\n\tMon, 11 Sep 2017 15:31:37 +0000 (UTC)"],"DMARC-Filter":"OpenDMARC Filter v1.3.2 mx1.redhat.com 2387AC0A524C","To":"P J P , Qemu Developers ","References":"<20170907063256.7418-1-ppandit@redhat.com>","From":"Paolo Bonzini ","Message-ID":"<2eae1293-6aec-e387-4bfd-940936894cdd@redhat.com>","Date":"Mon, 11 Sep 2017 17:31:34 +0200","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.2.1","MIME-Version":"1.0","In-Reply-To":"<20170907063256.7418-1-ppandit@redhat.com>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-US","Content-Transfer-Encoding":"7bit","X-Scanned-By":"MIMEDefang 2.79 on 10.5.11.15","X-Greylist":"Sender IP whitelisted, not delayed by milter-greylist-4.5.16\n\t(mx1.redhat.com [10.5.110.31]);\n\tMon, 11 Sep 2017 15:31:41 +0000 (UTC)","X-detected-operating-system":"by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]\n\t[fuzzy]","X-Received-From":"209.132.183.28","Subject":"Re: [Qemu-devel] [PATCH v1] multiboot: validate multiboot header\n\taddress values","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.21","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Cc":"Prasad J Pandit ,\n\tEduardo Habkost ,\n\tThomas Garnier ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"\"Qemu-devel\"\n\t"}}]