Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
Please login to access the resource
openSUSE:Step:FrontRunner
qemu.18973
0220-e1000-fail-early-for-evil-descripto.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0220-e1000-fail-early-for-evil-descripto.patch of Package qemu.18973
From: Jason Wang <jasowang@redhat.com> Date: Wed, 24 Feb 2021 13:45:28 +0800 Subject: e1000: fail early for evil descriptor Git-commit: 3de46e6fc489c52c9431a8a832ad8170a7569bd8 References: bsc#1182577, CVE-2021-20257 During procss_tx_desc(), driver can try to chain data descriptor with legacy descriptor, when will lead underflow for the following calculation in process_tx_desc() for bytes: if (tp->size + bytes > msh) bytes = msh - tp->size; This will lead a infinite loop. So check and fail early if tp->size if greater or equal to msh. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de> Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Bruce Rogers <brogers@suse.com> --- hw/net/e1000.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/e1000.c b/hw/net/e1000.c index 05a00cba31b7b53ff7c15e288d9b..c5d60d61540e1b1a4a4492b2e92d 100644 --- a/hw/net/e1000.c +++ b/hw/net/e1000.c @@ -647,6 +647,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) msh = tp->props.hdr_len + tp->props.mss; do { bytes = split_size; + if (tp->size >= msh) { + goto eop; + } if (tp->size + bytes > msh) bytes = msh - tp->size; @@ -674,6 +677,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) tp->size += split_size; } +eop: if (!(txd_lower & E1000_TXD_CMD_EOP)) return; if (!(tp->props.tse && tp->props.cptse && tp->size < tp->props.hdr_len)) {
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor