diff options
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu.inc | 2 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2021-20196_1.patch | 54 | ||||
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2021-20196_2.patch | 67 |
3 files changed, 123 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 35aa3e1d7e..568ef1be94 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc | |||
@@ -73,6 +73,8 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ | |||
73 | file://CVE-2021-3713.patch \ | 73 | file://CVE-2021-3713.patch \ |
74 | file://CVE-2021-3748.patch \ | 74 | file://CVE-2021-3748.patch \ |
75 | file://CVE-2021-3930.patch \ | 75 | file://CVE-2021-3930.patch \ |
76 | file://CVE-2021-20196_1.patch \ | ||
77 | file://CVE-2021-20196_2.patch \ | ||
76 | " | 78 | " |
77 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" | 79 | UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" |
78 | 80 | ||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-20196_1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-20196_1.patch new file mode 100644 index 0000000000..8b1ad0423b --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-20196_1.patch | |||
@@ -0,0 +1,54 @@ | |||
1 | From e907ff3d4cb7fd20d402f45355059e67d0dc93e7 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com> | ||
3 | Date: Wed, 24 Nov 2021 17:15:34 +0100 | ||
4 | Subject: [PATCH 11/12] hw/block/fdc: Extract blk_create_empty_drive() | ||
5 | MIME-Version: 1.0 | ||
6 | Content-Type: text/plain; charset=UTF-8 | ||
7 | Content-Transfer-Encoding: 8bit | ||
8 | |||
9 | We are going to re-use this code in the next commit, | ||
10 | so extract it as a new blk_create_empty_drive() function. | ||
11 | |||
12 | Inspired-by: Hanna Reitz <hreitz@redhat.com> | ||
13 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
14 | Message-id: 20211124161536.631563-2-philmd@redhat.com | ||
15 | Signed-off-by: John Snow <jsnow@redhat.com> | ||
16 | |||
17 | Upstream-Status: Backport [b154791e7b6d4ca5cdcd54443484d97360bd7ad2] | ||
18 | CVE: CVE-2021-20196 | ||
19 | |||
20 | Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> | ||
21 | --- | ||
22 | hw/block/fdc.c | 9 +++++++-- | ||
23 | 1 file changed, 7 insertions(+), 2 deletions(-) | ||
24 | |||
25 | diff --git a/hw/block/fdc.c b/hw/block/fdc.c | ||
26 | index 4c2c35e22..854b4f172 100644 | ||
27 | --- a/hw/block/fdc.c | ||
28 | +++ b/hw/block/fdc.c | ||
29 | @@ -61,6 +61,12 @@ | ||
30 | } while (0) | ||
31 | |||
32 | |||
33 | +/* Anonymous BlockBackend for empty drive */ | ||
34 | +static BlockBackend *blk_create_empty_drive(void) | ||
35 | +{ | ||
36 | + return blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL); | ||
37 | +} | ||
38 | + | ||
39 | /********************************************************/ | ||
40 | /* qdev floppy bus */ | ||
41 | |||
42 | @@ -543,8 +549,7 @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp) | ||
43 | } | ||
44 | |||
45 | if (!dev->conf.blk) { | ||
46 | - /* Anonymous BlockBackend for an empty drive */ | ||
47 | - dev->conf.blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL); | ||
48 | + dev->conf.blk = blk_create_empty_drive(); | ||
49 | ret = blk_attach_dev(dev->conf.blk, qdev); | ||
50 | assert(ret == 0); | ||
51 | |||
52 | -- | ||
53 | 2.31.1 | ||
54 | |||
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-20196_2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-20196_2.patch new file mode 100644 index 0000000000..dd442ccb8f --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-20196_2.patch | |||
@@ -0,0 +1,67 @@ | |||
1 | From 1d48445a951fd5504190a38abeda70ea9372cf77 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com> | ||
3 | Date: Wed, 24 Nov 2021 17:15:35 +0100 | ||
4 | Subject: [PATCH 12/12] hw/block/fdc: Kludge missing floppy drive to fix | ||
5 | CVE-2021-20196 | ||
6 | MIME-Version: 1.0 | ||
7 | Content-Type: text/plain; charset=UTF-8 | ||
8 | Content-Transfer-Encoding: 8bit | ||
9 | |||
10 | Guest might select another drive on the bus by setting the | ||
11 | DRIVE_SEL bit of the DIGITAL OUTPUT REGISTER (DOR). | ||
12 | The current controller model doesn't expect a BlockBackend | ||
13 | to be NULL. A simple way to fix CVE-2021-20196 is to create | ||
14 | an empty BlockBackend when it is missing. All further | ||
15 | accesses will be safely handled, and the controller state | ||
16 | machines keep behaving correctly. | ||
17 | |||
18 | Cc: qemu-stable@nongnu.org | ||
19 | Fixes: CVE-2021-20196 | ||
20 | Reported-by: Gaoning Pan (Ant Security Light-Year Lab) <pgn@zju.edu.cn> | ||
21 | Reviewed-by: Darren Kenny <darren.kenny@oracle.com> | ||
22 | Reviewed-by: Hanna Reitz <hreitz@redhat.com> | ||
23 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
24 | Message-id: 20211124161536.631563-3-philmd@redhat.com | ||
25 | BugLink: https://bugs.launchpad.net/qemu/+bug/1912780 | ||
26 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/338 | ||
27 | Reviewed-by: Darren Kenny <darren.kenny@oracle.com> | ||
28 | Reviewed-by: Hanna Reitz <hreitz@redhat.com> | ||
29 | Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> | ||
30 | Signed-off-by: John Snow <jsnow@redhat.com> | ||
31 | |||
32 | Upstream-Status: Backport [1ab95af033a419e7a64e2d58e67dd96b20af5233] | ||
33 | CVE: CVE-2021-20196 | ||
34 | |||
35 | Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> | ||
36 | --- | ||
37 | hw/block/fdc.c | 14 +++++++++++++- | ||
38 | 1 file changed, 13 insertions(+), 1 deletion(-) | ||
39 | |||
40 | diff --git a/hw/block/fdc.c b/hw/block/fdc.c | ||
41 | index 854b4f172..a736c4d14 100644 | ||
42 | --- a/hw/block/fdc.c | ||
43 | +++ b/hw/block/fdc.c | ||
44 | @@ -1365,7 +1365,19 @@ static FDrive *get_drv(FDCtrl *fdctrl, int unit) | ||
45 | |||
46 | static FDrive *get_cur_drv(FDCtrl *fdctrl) | ||
47 | { | ||
48 | - return get_drv(fdctrl, fdctrl->cur_drv); | ||
49 | + FDrive *cur_drv = get_drv(fdctrl, fdctrl->cur_drv); | ||
50 | + | ||
51 | + if (!cur_drv->blk) { | ||
52 | + /* | ||
53 | + * Kludge: empty drive line selected. Create an anonymous | ||
54 | + * BlockBackend to avoid NULL deref with various BlockBackend | ||
55 | + * API calls within this model (CVE-2021-20196). | ||
56 | + * Due to the controller QOM model limitations, we don't | ||
57 | + * attach the created to the controller device. | ||
58 | + */ | ||
59 | + cur_drv->blk = blk_create_empty_drive(); | ||
60 | + } | ||
61 | + return cur_drv; | ||
62 | } | ||
63 | |||
64 | /* Status A register : 0x00 (read-only) */ | ||
65 | -- | ||
66 | 2.31.1 | ||
67 | |||