File CVE-2016-3710-qemut-0005-vga-make-sure-vga-regi... of Package xen.3680

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-3710-qemut-0005-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch of Package xen.3680

References: bsc#978164 CVE-2016-3710 XSA-179

From 0b0cf8110e97b0cbd0da73d11163e26978822757 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 26 Apr 2016 14:48:06 +0200
Subject: [PATCH 5/5] vga: make sure vga register setup for vbe stays intact
 (CVE-2016-3712).

Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
registers, to make sure the vga registers will always have the
values needed by vbe mode.  This makes sure the sanity checks
applied by vbe_fixup_regs() are effective.

Without this guests can muck with shift_control, can turn on planar
vga modes or text mode emulation while VBE is active, making qemu
take code paths meant for CGA compatibility, but with the very
large display widths and heigts settable using VBE registers.

Which is good for one or another buffer overflow.  Not that
critical as they typically read overflows happening somewhere
in the display code.  So guests can DoS by crashing qemu with a
segfault, but it is probably not possible to break out of the VM.

Fixes: CVE-2016-3712
Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
Reported-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
[Backport to qemu-xen-tradition]
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
 hw/vga.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

Index: xen-4.4.4-testing/tools/qemu-xen-traditional-dir-remote/hw/vga.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/vga.c
+++ xen-4.4.4-testing/tools/qemu-xen-traditional-dir-remote/hw/vga.c
@@ -160,6 +160,8 @@ static uint32_t expand4[256];
 static uint16_t expand2[256];
 static uint8_t expand4to8[16];
 
+static void vbe_update_vgaregs(VGAState *s);
+
 static inline bool vbe_enabled(VGAState *s)
 {
     return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED;
@@ -449,6 +451,7 @@ static void vga_ioport_write(void *opaqu
         printf("vga: write SR%x = 0x%02x\n", s->sr_index, val);
 #endif
         s->sr[s->sr_index] = val & sr_mask[s->sr_index];
+        vbe_update_vgaregs(s);
         if (s->sr_index == 1) s->update_retrace_info(s);
         break;
     case 0x3c7:
@@ -477,6 +480,7 @@ static void vga_ioport_write(void *opaqu
         printf("vga: write GR%x = 0x%02x\n", s->gr_index, val);
 #endif
         s->gr[s->gr_index] = val & gr_mask[s->gr_index];
+        vbe_update_vgaregs(s);
         break;
     case 0x3b4:
     case 0x3d4:
@@ -490,8 +494,10 @@ static void vga_ioport_write(void *opaqu
         /* handle CR0-7 protection */
         if ((s->cr[0x11] & 0x80) && s->cr_index <= 7) {
             /* can always write bit 4 of CR7 */
-            if (s->cr_index == 7)
+            if (s->cr_index == 7) {
                 s->cr[7] = (s->cr[7] & ~0x10) | (val & 0x10);
+                vbe_update_vgaregs(s);
+            }
             return;
         }
         switch(s->cr_index) {
@@ -507,6 +513,7 @@ static void vga_ioport_write(void *opaqu
             s->cr[s->cr_index] = val;
             break;
         }
+        vbe_update_vgaregs(s);
 
         switch(s->cr_index) {
         case 0x00:

Places

File CVE-2016-3710-qemut-0005-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch of Package xen.3680

Places