diff options
| author | zhenwei pi <pizhenwei@bytedance.com> | 2023-08-03 10:43:13 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2023-08-03 16:16:17 -0400 |
| commit | 9d38a8434721a6479fe03fb5afb150ca793d3980 (patch) | |
| tree | 904d581ee15f1a7d52defe593b2000da31a4bea2 /hw/tpm | |
| parent | e1e56c07d1fa24aa37a7e89e6633768fc8ea8705 (diff) | |
| download | qemu-9d38a8434721a6479fe03fb5afb150ca793d3980.zip qemu-9d38a8434721a6479fe03fb5afb150ca793d3980.tar.gz qemu-9d38a8434721a6479fe03fb5afb150ca793d3980.tar.bz2 | |
virtio-crypto: verify src&dst buffer length for sym request
For symmetric algorithms, the length of ciphertext must be as same
as the plaintext.
The missing verification of the src_len and the dst_len in
virtio_crypto_sym_op_helper() may lead buffer overflow/divulged.
This patch is originally written by Yiming Tao for QEMU-SECURITY,
resend it(a few changes of error message) in qemu-devel.
Fixes: CVE-2023-3180
Fixes: 04b9b37edda("virtio-crypto: add data queue processing handler")
Cc: Gonglei <arei.gonglei@huawei.com>
Cc: Mauro Matteo Cascella <mcascell@redhat.com>
Cc: Yiming Tao <taoym@zju.edu.cn>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20230803024314.29962-2-pizhenwei@bytedance.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/tpm')
0 files changed, 0 insertions, 0 deletions