diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2021-08-18 14:05:05 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2021-09-01 06:34:00 +0200 |
| commit | 13b250b12ad3c59114a6a17d59caf073ce45b33a (patch) | |
| tree | 0f79d14314c1c36f499a29e2eedaf5ff5b7626c9 /hw | |
| parent | ad22d0583300df420819e6c89b1c022b998fac8a (diff) | |
| download | qemu-13b250b12ad3c59114a6a17d59caf073ce45b33a.zip qemu-13b250b12ad3c59114a6a17d59caf073ce45b33a.tar.gz qemu-13b250b12ad3c59114a6a17d59caf073ce45b33a.tar.bz2 | |
uas: add stream number sanity checks.
The device uses the guest-supplied stream number unchecked, which can
lead to guest-triggered out-of-band access to the UASDevice->data3 and
UASDevice->status3 fields. Add the missing checks.
Fixes: CVE-2021-3713
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reported-by: Chen Zhe <chenzhe@huawei.com>
Reported-by: Tan Jingguo <tanjingguo@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210818120505.1258262-2-kraxel@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/usb/dev-uas.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c index 2630562..f6309a5 100644 --- a/hw/usb/dev-uas.c +++ b/hw/usb/dev-uas.c @@ -840,6 +840,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) } break; case UAS_PIPE_ID_STATUS: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { QTAILQ_FOREACH(st, &uas->results, next) { if (st->stream == p->stream) { @@ -867,6 +870,9 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) break; case UAS_PIPE_ID_DATA_IN: case UAS_PIPE_ID_DATA_OUT: + if (p->stream > UAS_MAX_STREAMS) { + goto err_stream; + } if (p->stream) { req = usb_uas_find_request(uas, p->stream); } else { @@ -902,6 +908,11 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p) p->status = USB_RET_STALL; break; } + +err_stream: + error_report("%s: invalid stream %d", __func__, p->stream); + p->status = USB_RET_STALL; + return; } static void usb_uas_unrealize(USBDevice *dev) |