diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch | 115 |
1 files changed, 115 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch new file mode 100644 index 0000000000..acc93e897b --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3507_2.patch | |||
@@ -0,0 +1,115 @@ | |||
1 | From 3e8601ec707dcbc3c768f7733d016dc70c947e4a Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com> | ||
3 | Date: Thu, 18 Nov 2021 12:57:33 +0100 | ||
4 | Subject: [PATCH 2/2] tests/qtest/fdc-test: Add a regression test for | ||
5 | CVE-2021-3507 | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | Add the reproducer from https://gitlab.com/qemu-project/qemu/-/issues/339 | ||
11 | |||
12 | Without the previous commit, when running 'make check-qtest-i386' | ||
13 | with QEMU configured with '--enable-sanitizers' we get: | ||
14 | |||
15 | ==4028352==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000062a00 at pc 0x5626d03c491a bp 0x7ffdb4199410 sp 0x7ffdb4198bc0 | ||
16 | READ of size 786432 at 0x619000062a00 thread T0 | ||
17 | #0 0x5626d03c4919 in __asan_memcpy (qemu-system-i386+0x1e65919) | ||
18 | #1 0x5626d1c023cc in flatview_write_continue softmmu/physmem.c:2787:13 | ||
19 | #2 0x5626d1bf0c0f in flatview_write softmmu/physmem.c:2822:14 | ||
20 | #3 0x5626d1bf0798 in address_space_write softmmu/physmem.c:2914:18 | ||
21 | #4 0x5626d1bf0f37 in address_space_rw softmmu/physmem.c:2924:16 | ||
22 | #5 0x5626d1bf14c8 in cpu_physical_memory_rw softmmu/physmem.c:2933:5 | ||
23 | #6 0x5626d0bd5649 in cpu_physical_memory_write include/exec/cpu-common.h:82:5 | ||
24 | #7 0x5626d0bd0a07 in i8257_dma_write_memory hw/dma/i8257.c:452:9 | ||
25 | #8 0x5626d09f825d in fdctrl_transfer_handler hw/block/fdc.c:1616:13 | ||
26 | #9 0x5626d0a048b4 in fdctrl_start_transfer hw/block/fdc.c:1539:13 | ||
27 | #10 0x5626d09f4c3e in fdctrl_write_data hw/block/fdc.c:2266:13 | ||
28 | #11 0x5626d09f22f7 in fdctrl_write hw/block/fdc.c:829:9 | ||
29 | #12 0x5626d1c20bc5 in portio_write softmmu/ioport.c:207:17 | ||
30 | |||
31 | 0x619000062a00 is located 0 bytes to the right of 512-byte region [0x619000062800,0x619000062a00) | ||
32 | allocated by thread T0 here: | ||
33 | #0 0x5626d03c66ec in posix_memalign (qemu-system-i386+0x1e676ec) | ||
34 | #1 0x5626d2b988d4 in qemu_try_memalign util/oslib-posix.c:210:11 | ||
35 | #2 0x5626d2b98b0c in qemu_memalign util/oslib-posix.c:226:27 | ||
36 | #3 0x5626d09fbaf0 in fdctrl_realize_common hw/block/fdc.c:2341:20 | ||
37 | #4 0x5626d0a150ed in isabus_fdc_realize hw/block/fdc-isa.c:113:5 | ||
38 | #5 0x5626d2367935 in device_set_realized hw/core/qdev.c:531:13 | ||
39 | |||
40 | SUMMARY: AddressSanitizer: heap-buffer-overflow (qemu-system-i386+0x1e65919) in __asan_memcpy | ||
41 | Shadow bytes around the buggy address: | ||
42 | 0x0c32800044f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa | ||
43 | 0x0c3280004500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
44 | 0x0c3280004510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
45 | 0x0c3280004520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
46 | 0x0c3280004530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ||
47 | =>0x0c3280004540:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa | ||
48 | 0x0c3280004550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa | ||
49 | 0x0c3280004560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa | ||
50 | 0x0c3280004570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa | ||
51 | 0x0c3280004580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa | ||
52 | 0x0c3280004590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd | ||
53 | Shadow byte legend (one shadow byte represents 8 application bytes): | ||
54 | Addressable: 00 | ||
55 | Heap left redzone: fa | ||
56 | Freed heap region: fd | ||
57 | ==4028352==ABORTING | ||
58 | |||
59 | [ kwolf: Added snapshot=on to prevent write file lock failure ] | ||
60 | |||
61 | Reported-by: Alexander Bulekov <alxndr@bu.edu> | ||
62 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
63 | Reviewed-by: Alexander Bulekov <alxndr@bu.edu> | ||
64 | Signed-off-by: Kevin Wolf <kwolf@redhat.com> | ||
65 | |||
66 | Upstream-Status: Backport [46609b90d9e3a6304def11038a76b58ff43f77bc] | ||
67 | CVE: CVE-2021-3507 | ||
68 | |||
69 | Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> | ||
70 | --- | ||
71 | tests/qtest/fdc-test.c | 21 +++++++++++++++++++++ | ||
72 | 1 file changed, 21 insertions(+) | ||
73 | |||
74 | diff --git a/tests/qtest/fdc-test.c b/tests/qtest/fdc-test.c | ||
75 | index b0d40012e..1d4f85212 100644 | ||
76 | --- a/tests/qtest/fdc-test.c | ||
77 | +++ b/tests/qtest/fdc-test.c | ||
78 | @@ -583,6 +583,26 @@ static void test_cve_2021_20196(void) | ||
79 | qtest_quit(s); | ||
80 | } | ||
81 | |||
82 | +static void test_cve_2021_3507(void) | ||
83 | +{ | ||
84 | + QTestState *s; | ||
85 | + | ||
86 | + s = qtest_initf("-nographic -m 32M -nodefaults " | ||
87 | + "-drive file=%s,format=raw,if=floppy,snapshot=on", | ||
88 | + test_image); | ||
89 | + qtest_outl(s, 0x9, 0x0a0206); | ||
90 | + qtest_outw(s, 0x3f4, 0x1600); | ||
91 | + qtest_outw(s, 0x3f4, 0x0000); | ||
92 | + qtest_outw(s, 0x3f4, 0x0000); | ||
93 | + qtest_outw(s, 0x3f4, 0x0000); | ||
94 | + qtest_outw(s, 0x3f4, 0x0200); | ||
95 | + qtest_outw(s, 0x3f4, 0x0200); | ||
96 | + qtest_outw(s, 0x3f4, 0x0000); | ||
97 | + qtest_outw(s, 0x3f4, 0x0000); | ||
98 | + qtest_outw(s, 0x3f4, 0x0000); | ||
99 | + qtest_quit(s); | ||
100 | +} | ||
101 | + | ||
102 | int main(int argc, char **argv) | ||
103 | { | ||
104 | int fd; | ||
105 | @@ -614,6 +634,7 @@ int main(int argc, char **argv) | ||
106 | qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19); | ||
107 | qtest_add_func("/fdc/fuzz-registers", fuzz_registers); | ||
108 | qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196); | ||
109 | + qtest_add_func("/fdc/fuzz/cve_2021_3507", test_cve_2021_3507); | ||
110 | |||
111 | ret = g_test_run(); | ||
112 | |||
113 | -- | ||
114 | 2.33.0 | ||
115 | |||