summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc1
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-24352.patch52
2 files changed, 53 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 84f600cec0..11be545cb5 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -32,6 +32,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
32 file://find_datadir.patch \ 32 file://find_datadir.patch \
33 file://usb-fix-setup_len-init.patch \ 33 file://usb-fix-setup_len-init.patch \
34 file://0001-target-mips-Increase-number-of-TLB-entries-on-the-34.patch \ 34 file://0001-target-mips-Increase-number-of-TLB-entries-on-the-34.patch \
35 file://CVE-2020-24352.patch \
35 " 36 "
36UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 37UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
37 38
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-24352.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-24352.patch
new file mode 100644
index 0000000000..861ff6c3b0
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2020-24352.patch
@@ -0,0 +1,52 @@
1From ca1f9cbfdce4d63b10d57de80fef89a89d92a540 Mon Sep 17 00:00:00 2001
2From: Prasad J Pandit <pjp@fedoraproject.org>
3Date: Wed, 21 Oct 2020 16:08:18 +0530
4Subject: [PATCH 1/1] ati: check x y display parameter values
5
6The source and destination x,y display parameters in ati_2d_blt()
7may run off the vga limits if either of s->regs.[src|dst]_[xy] is
8zero. Check the parameter values to avoid potential crash.
9
10Reported-by: Gaoning Pan <pgn@zju.edu.cn>
11Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
12Message-id: 20201021103818.1704030-1-ppandit@redhat.com
13Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
14
15Upstream-Status: Backport [ https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ca1f9cbfdce4d63b10d57de80fef89a89d92a540;hp=2ddafce7f797082ad216657c830afd4546f16e37 ]
16CVE: CVE-2020-24352
17Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
18---
19 hw/display/ati_2d.c | 10 ++++++----
20 1 file changed, 6 insertions(+), 4 deletions(-)
21
22diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
23index 23a8ae0..4dc10ea 100644
24--- a/hw/display/ati_2d.c
25+++ b/hw/display/ati_2d.c
26@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s)
27 dst_stride *= bpp;
28 }
29 uint8_t *end = s->vga.vram_ptr + s->vga.vram_size;
30- if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) *
31- dst_stride >= end) {
32+ if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end
33+ || dst_bits + dst_x
34+ + (dst_y + s->regs.dst_height) * dst_stride >= end) {
35 qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
36 return;
37 }
38@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s)
39 src_bits += s->regs.crtc_offset & 0x07ffffff;
40 src_stride *= bpp;
41 }
42- if (src_bits >= end || src_bits + src_x +
43- (src_y + s->regs.dst_height) * src_stride >= end) {
44+ if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end
45+ || src_bits + src_x
46+ + (src_y + s->regs.dst_height) * src_stride >= end) {
47 qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
48 return;
49 }
50--
511.8.3.1
52