summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Maier <tamiko@gentoo.org>2016-06-14 00:37:13 -0500
committerMatthias Maier <tamiko@gentoo.org>2016-06-14 00:46:47 -0500
commit76546db063fa388fbd42de1860e0d79d17948011 (patch)
tree2d125ca3c1c34f9adab27d3614dbe663a3526397 /app-emulation/spice/files
parentapp-emulation/spice: fix vuln 0.12.7, bug #584126 (diff)
downloadgentoo-76546db063fa388fbd42de1860e0d79d17948011.tar.gz
gentoo-76546db063fa388fbd42de1860e0d79d17948011.tar.bz2
gentoo-76546db063fa388fbd42de1860e0d79d17948011.zip
app-emulation/spice: fix vuln 0.13.1, bug #584126
Apply the following patches to 0.13.1: CVE-2016-2150: Commits 69628ea1375282cb7ca5b4dc4410e7aa67e0fc02 Commits 790d8f3e53d324f496fc719498422e433aae8654 *instead of* 0067-create-a-function-to-validate-surface-parameters.patch *instead of* 0068-improve-primary-surface-parameter-checks.patch CVE-2016-0749: Ported the following commits to 0.13.1 (patches did not apply due to refactoring of some internal data structures and renaming). *modified* 0065-smartcard-add-a-ref-to-item-before-adding-to-pipe.patch *modified* 0066-smartcard-allocate-msg-with-the-expected-size.patch Gentoo-Bug: 584126 Package-Manager: portage-2.2.28
Diffstat (limited to 'app-emulation/spice/files')
-rw-r--r--app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch56
-rw-r--r--app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch50
-rw-r--r--app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch109
-rw-r--r--app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch50
4 files changed, 265 insertions, 0 deletions
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch
new file mode 100644
index 000000000000..cd1c8ef1df67
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch
@@ -0,0 +1,56 @@
+From fd4a179a15882234f86ded87905a240dc76a9445 Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Tue, 14 Jun 2016 00:08:05 -0500
+Subject: [PATCH 1/2] Port fix for CVE-2016-0749 to 0.13.1, part I
+
+This is a port of
+
+ 0065-smartcard-add-a-ref-to-item-before-adding-to-pipe.patch
+
+to version 0.13.1
+
+Original commit message:
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+Date: Thu, 17 Dec 2015 18:13:47 +0100
+Subject: [PATCH] smartcard: add a ref to item before adding to pipe
+
+There is an unref when the message is sent.
+
+[...]
+
+Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+---
+ server/smartcard.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/server/smartcard.c b/server/smartcard.c
+index ba6f2f5..96e4295 100644
+--- a/server/smartcard.c
++++ b/server/smartcard.c
+@@ -181,14 +181,18 @@ static void smartcard_unref_msg_to_client(RedCharDeviceMsgToClient *msg,
+ smartcard_unref_vsc_msg_item((MsgItem *)msg);
+ }
+
+-static void smartcard_send_msg_to_client(RedCharDeviceMsgToClient *msg,
++static void smartcard_send_msg_to_client(RedCharDeviceMsgToClient *message,
+ RedClient *client,
+ void *opaque)
+ {
+ RedCharDeviceSmartcard *dev = opaque;
+- spice_assert(dev->priv->scc && dev->priv->scc->base.client == client);
+- smartcard_channel_client_pipe_add_push(&dev->priv->scc->base, &((MsgItem *)msg)->base);
+
++ MsgItem *msg = (MsgItem *)message;
++ PipeItem *item = &msg->base;
++
++ spice_assert(dev->priv->scc && dev->priv->scc->base.client == client);
++ smartcard_ref_vsc_msg_item(msg);
++ smartcard_channel_client_pipe_add_push(&dev->priv->scc->base, item);
+ }
+
+ static void smartcard_send_tokens_to_client(RedClient *client, uint32_t tokens, void *opaque)
+--
+2.7.3
+
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch
new file mode 100644
index 000000000000..6a1895f247f9
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch
@@ -0,0 +1,50 @@
+From 4cd23b8378e68283c7c9cf0b1e25dae11cf69c3e Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Tue, 14 Jun 2016 00:15:48 -0500
+Subject: [PATCH 2/2] Port fix for CVE-2016-0749 to 0.13.1, part II
+
+This is a port of
+
+ 0066-smartcard-allocate-msg-with-the-expected-size.patch
+
+to version 0.13.1
+
+Original commit message:
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+Date: Thu, 17 Dec 2015 18:16:22 +0100
+Subject: [PATCH] smartcard: allocate msg with the expected size
+
+[...]
+
+Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+---
+ server/smartcard.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/server/smartcard.c b/server/smartcard.c
+index 96e4295..c317512 100644
+--- a/server/smartcard.c
++++ b/server/smartcard.c
+@@ -313,7 +313,7 @@ static void smartcard_char_device_notify_reader_add(RedCharDeviceSmartcard *dev)
+ RedCharDeviceWriteBuffer *write_buf;
+ VSCMsgHeader *vheader;
+
+- write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(vheader));
++ write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(*vheader));
+ if (!write_buf) {
+ spice_error("failed to allocate write buffer");
+ return;
+@@ -360,7 +360,7 @@ static void smartcard_char_device_notify_reader_remove(RedCharDeviceSmartcard *d
+ spice_debug("reader add was never sent to the device");
+ return;
+ }
+- write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(vheader));
++ write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(*vheader));
+ if (!write_buf) {
+ spice_error("failed to allocate write buffer");
+ return;
+--
+2.7.3
+
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch
new file mode 100644
index 000000000000..e814975e5f38
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch
@@ -0,0 +1,109 @@
+From fc06265c3780e05503410a6646d1434e15d25b03 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Mon, 29 Feb 2016 14:24:03 +0000
+Subject: [PATCH 1/2] factor out red_validate_surface function to validate
+ surface parameters
+
+Make possible to reuse it outside red-parse-qxl.c.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/red-parse-qxl.c | 49 ++++++++++++++++++++++++++++++++-----------------
+ server/red-parse-qxl.h | 3 +++
+ 2 files changed, 35 insertions(+), 17 deletions(-)
+
+diff --git a/server/red-parse-qxl.c b/server/red-parse-qxl.c
+index 18b7ea6..b462311 100644
+--- a/server/red-parse-qxl.c
++++ b/server/red-parse-qxl.c
+@@ -1327,13 +1327,41 @@ static unsigned int surface_format_to_bpp(uint32_t format)
+ return 0;
+ }
+
++bool red_validate_surface(uint32_t width, uint32_t height,
++ int32_t stride, uint32_t format)
++{
++ unsigned int bpp;
++ uint64_t size;
++
++ bpp = surface_format_to_bpp(format);
++
++ /* check if format is valid */
++ if (!bpp) {
++ return false;
++ }
++
++ /* check stride is larger than required bytes */
++ size = ((uint64_t) width * bpp + 7u) / 8u;
++ /* the uint32_t conversion is here to avoid problems with -2^31 value */
++ if (stride == G_MININT32 || size > (uint32_t) abs(stride)) {
++ return false;
++ }
++
++ /* the multiplication can overflow, also abs(-2^31) may return a negative value */
++ size = (uint64_t) height * abs(stride);
++ if (size > MAX_DATA_CHUNK) {
++ return false;
++ }
++
++ return true;
++}
++
+ int red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
+ RedSurfaceCmd *red, QXLPHYSICAL addr)
+ {
+ QXLSurfaceCmd *qxl;
+ uint64_t size;
+ int error;
+- unsigned int bpp;
+
+ qxl = (QXLSurfaceCmd *)memslot_get_virt(slots, addr, sizeof(*qxl), group_id,
+ &error);
+@@ -1353,26 +1381,13 @@ int red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
+ red->u.surface_create.width = qxl->u.surface_create.width;
+ red->u.surface_create.height = qxl->u.surface_create.height;
+ red->u.surface_create.stride = qxl->u.surface_create.stride;
+- bpp = surface_format_to_bpp(red->u.surface_create.format);
+
+- /* check if format is valid */
+- if (!bpp) {
++ if (!red_validate_surface(red->u.surface_create.width, red->u.surface_create.height,
++ red->u.surface_create.stride, red->u.surface_create.format)) {
+ return 1;
+ }
+
+- /* check stride is larger than required bytes */
+- size = ((uint64_t) red->u.surface_create.width * bpp + 7u) / 8u;
+- /* the uint32_t conversion is here to avoid problems with -2^31 value */
+- if (red->u.surface_create.stride == G_MININT32
+- || size > (uint32_t) abs(red->u.surface_create.stride)) {
+- return 1;
+- }
+-
+- /* the multiplication can overflow, also abs(-2^31) may return a negative value */
+- size = (uint64_t) red->u.surface_create.height * abs(red->u.surface_create.stride);
+- if (size > MAX_DATA_CHUNK) {
+- return 1;
+- }
++ size = red->u.surface_create.height * abs(red->u.surface_create.stride);
+ red->u.surface_create.data =
+ (uint8_t*)memslot_get_virt(slots, qxl->u.surface_create.data, size, group_id, &error);
+ if (error) {
+diff --git a/server/red-parse-qxl.h b/server/red-parse-qxl.h
+index 9c30572..72a57b4 100644
+--- a/server/red-parse-qxl.h
++++ b/server/red-parse-qxl.h
+@@ -127,6 +127,9 @@ int red_get_message(RedMemSlotInfo *slots, int group_id,
+ RedMessage *red, QXLPHYSICAL addr);
+ void red_put_message(RedMessage *red);
+
++bool red_validate_surface(uint32_t width, uint32_t height,
++ int32_t stride, uint32_t format);
++
+ int red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
+ RedSurfaceCmd *red, QXLPHYSICAL addr);
+ void red_put_surface_cmd(RedSurfaceCmd *red);
+--
+2.7.3
+
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch
new file mode 100644
index 000000000000..a452969d6f1c
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch
@@ -0,0 +1,50 @@
+From b1c167bb9e8047e93bfd43a43832963c8e830f5b Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Wed, 2 Mar 2016 12:35:41 +0000
+Subject: [PATCH 2/2] improve primary surface parameter checks
+
+Primary surface, as additional surfaces, can be used to access
+host memory from the guest using invalid parameters.
+
+The removed warning is not enough to prevent all cases. Also a warning
+is not enough to stop an escalation to happen.
+The red_validate_surface do different checks to make sure surface
+request is valid and not cause possible buffer/integer overflows:
+- format is valid;
+- width is not large to cause overflow compared to stride;
+- stride is not -2^31 (a number which negate is still <0);
+- stride * height does not overflow.
+
+This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1312980.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/red-worker.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/server/red-worker.c b/server/red-worker.c
+index 241c300..c7fc8bd 100644
+--- a/server/red-worker.c
++++ b/server/red-worker.c
+@@ -681,8 +681,15 @@ static void dev_create_primary_surface(RedWorker *worker, uint32_t surface_id,
+ spice_debug(NULL);
+ spice_warn_if_fail(surface_id == 0);
+ spice_warn_if_fail(surface.height != 0);
+- spice_warn_if_fail(((uint64_t)abs(surface.stride) * (uint64_t)surface.height) ==
+- abs(surface.stride) * surface.height);
++
++ /* surface can arrive from guest unchecked so make sure
++ * guest is not a malicious one and drop invalid requests
++ */
++ if (!red_validate_surface(surface.width, surface.height,
++ surface.stride, surface.format)) {
++ spice_warning("wrong primary surface creation request");
++ return;
++ }
+
+ line_0 = (uint8_t*)memslot_get_virt(&worker->mem_slots, surface.mem,
+ surface.height * abs(surface.stride),
+--
+2.7.3
+