From e53f7d53f40df75c25e6cdbd1a19b16b296d307b Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Wed, 29 May 2019 11:14:38 -0700 Subject: qemu: Security fix for CVE-2018-19489 Source: Qemu.org MR: 97453 Type: Security Fix Disposition: Backport from git.qemu.org/gemu.git ChangeID: a06fcb432d447cec2ed1caf112822dd1b4831ace Description: In the spirt of YP Compatible, sending change upstream. fixes CVE CVE-2018-19489 Affect < = 4.0.0 (From OE-Core rev: 249447828cd1ed13f9faf19793208b503acf0d30) Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- .../qemu/qemu/CVE-2018-19489.patch | 83 ++++++++++++++++++++++ meta/recipes-devtools/qemu/qemu_3.0.0.bb | 1 + 2 files changed, 84 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch b/meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch new file mode 100644 index 0000000000..7619e2a8ca --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-19489.patch @@ -0,0 +1,83 @@ +From 1d20398694a3b67a388d955b7a945ba4aa90a8a8 Mon Sep 17 00:00:00 2001 +From: Greg Kurz +Date: Fri, 23 Nov 2018 13:28:03 +0100 +Subject: [PATCH] 9p: fix QEMU crash when renaming files + +When using the 9P2000.u version of the protocol, the following shell +command line in the guest can cause QEMU to crash: + + while true; do rm -rf aa; mkdir -p a/b & touch a/b/c & mv a aa; done + +With 9P2000.u, file renaming is handled by the WSTAT command. The +v9fs_wstat() function calls v9fs_complete_rename(), which calls +v9fs_fix_path() for every fid whose path is affected by the change. +The involved calls to v9fs_path_copy() may race with any other access +to the fid path performed by some worker thread, causing a crash like +shown below: + +Thread 12 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. +0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, path=0x0, + flags=65536, mode=0) at hw/9pfs/9p-local.c:59 +59 while (*path && fd != -1) { +(gdb) bt +#0 0x0000555555a25da2 in local_open_nofollow (fs_ctx=0x555557d958b8, + path=0x0, flags=65536, mode=0) at hw/9pfs/9p-local.c:59 +#1 0x0000555555a25e0c in local_opendir_nofollow (fs_ctx=0x555557d958b8, + path=0x0) at hw/9pfs/9p-local.c:92 +#2 0x0000555555a261b8 in local_lstat (fs_ctx=0x555557d958b8, + fs_path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/9p-local.c:185 +#3 0x0000555555a2b367 in v9fs_co_lstat (pdu=0x555557d97498, + path=0x555556b56858, stbuf=0x7fff84830ef0) at hw/9pfs/cofile.c:53 +#4 0x0000555555a1e9e2 in v9fs_stat (opaque=0x555557d97498) + at hw/9pfs/9p.c:1083 +#5 0x0000555555e060a2 in coroutine_trampoline (i0=-669165424, i1=32767) + at util/coroutine-ucontext.c:116 +#6 0x00007fffef4f5600 in __start_context () at /lib64/libc.so.6 +#7 0x0000000000000000 in () +(gdb) + +The fix is to take the path write lock when calling v9fs_complete_rename(), +like in v9fs_rename(). + +Impact: DoS triggered by unprivileged guest users. + +Fixes: CVE-2018-19489 +Cc: P J P +Reported-by: zhibin hu +Reviewed-by: Prasad J Pandit +Signed-off-by: Greg Kurz + +Upstream-Status: Backport +Affects: < 4.0.0 +CVE: CVE-2018-19489 +Signed-off-by: Armin Kuster + +--- + hw/9pfs/9p.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c +index 267a255..bdf7919 100644 +--- a/hw/9pfs/9p.c ++++ b/hw/9pfs/9p.c +@@ -2855,6 +2855,7 @@ static void coroutine_fn v9fs_wstat(void *opaque) + struct stat stbuf; + V9fsFidState *fidp; + V9fsPDU *pdu = opaque; ++ V9fsState *s = pdu->s; + + v9fs_stat_init(&v9stat); + err = pdu_unmarshal(pdu, offset, "dwS", &fid, &unused, &v9stat); +@@ -2920,7 +2921,9 @@ static void coroutine_fn v9fs_wstat(void *opaque) + } + } + if (v9stat.name.size != 0) { ++ v9fs_path_write_lock(s); + err = v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); ++ v9fs_path_unlock(s); + if (err < 0) { + goto out; + } +-- +2.7.4 + diff --git a/meta/recipes-devtools/qemu/qemu_3.0.0.bb b/meta/recipes-devtools/qemu/qemu_3.0.0.bb index 59cfc38e4b..992cf7b1a8 100644 --- a/meta/recipes-devtools/qemu/qemu_3.0.0.bb +++ b/meta/recipes-devtools/qemu/qemu_3.0.0.bb @@ -30,6 +30,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://CVE-2018-18849.patch \ file://CVE-2018-19364_p1.patch \ file://CVE-2018-19364_p2.patch \ + file://CVE-2018-19489.patch \ " UPSTREAM_CHECK_REGEX = "qemu-(?P\d+(\.\d+)+)\.tar" -- cgit v1.2.3-54-g00ecf