Google Git
Sign in
qemu / qemu / 9f22893adcb02580aee5968f32baa2cd109b3ec2
commit9f22893adcb02580aee5968f32baa2cd109b3ec2[log] [tgz]
authorLi Qiang <liq3ea@163.com>Sat May 15 20:04:02 2021 -0700
committerGerd Hoffmann <kraxel@redhat.com>Thu May 27 11:55:59 2021 +0200
tree0c7ed9e162d074886ac73269a15b677c023a6714
parent63736af5a6571d9def93769431e0d7e38c6677bf [diff]
vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546)

If 'virgl_cmd_get_capset' set 'max_size' to 0,
the 'virgl_renderer_fill_caps' will write the data after the 'resp'.
This patch avoid this by checking the returned 'max_size'.

virtio-gpu fix: abd7f08b23 ("display: virtio-gpu-3d: check
virgl capabilities max_size")

Fixes: CVE-2021-3546
Reported-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-8-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
1 file changed
tree: 0c7ed9e162d074886ac73269a15b677c023a6714
  1. .github/
  2. .gitlab-ci.d/
  3. accel/
  4. audio/
  5. authz/
  6. backends/
  7. block/
  8. bsd-user/
  9. chardev/
  10. contrib/
  11. crypto/
  12. default-configs/
  13. disas/
  14. docs/
  15. dump/
  16. fpu/
  17. fsdev/
  18. gdb-xml/
  19. hw/
  20. include/
  21. io/
  22. libdecnumber/
  23. linux-headers/
  24. linux-user/
  25. migration/
  26. monitor/
  27. nbd/
  28. net/
  29. pc-bios/
  30. plugins/
  31. po/
  32. python/
  33. qapi/
  34. qga/
  35. qobject/
  36. qom/
  37. replay/
  38. roms/
  39. scripts/
  40. scsi/
  41. semihosting/
  42. softmmu/
  43. storage-daemon/
  44. stubs/
  45. subprojects/
  46. target/
  47. tcg/
  48. tests/
  49. tools/
  50. trace/
  51. ui/
  52. util/
  53. capstone
  54. dtc
  55. meson
  56. slirp
  57. .cirrus.yml
  58. .dir-locals.el
  59. .editorconfig
  60. .exrc
  61. .gdbinit
  62. .gitattributes
  63. .gitignore
  64. .gitlab-ci.yml
  65. .gitmodules
  66. .gitpublish
  67. .mailmap
  68. .patchew.yml
  69. .readthedocs.yml
  70. .travis.yml
  71. block.c
  72. blockdev-nbd.c
  73. blockdev.c
  74. blockjob.c
  75. configure
  76. COPYING
  77. COPYING.LIB
  78. cpu.c
  79. cpus-common.c
  80. disas.c
  81. gdbstub.c
  82. gitdm.config
  83. hmp-commands-info.hx
  84. hmp-commands.hx
  85. iothread.c
  86. job-qmp.c
  87. job.c
  88. Kconfig
  89. Kconfig.host
  90. LICENSE
  91. MAINTAINERS
  92. Makefile
  93. memory_ldst.c.inc
  94. meson.build
  95. meson_options.txt
  96. module-common.c
  97. os-posix.c
  98. os-win32.c
  99. page-vary-common.c
  100. page-vary.c
  101. qemu-bridge-helper.c
  102. qemu-edid.c
  103. qemu-img-cmds.hx
  104. qemu-img.c
  105. qemu-io-cmds.c
  106. qemu-io.c
  107. qemu-keymap.c
  108. qemu-nbd.c
  109. qemu-options-wrapper.h
  110. qemu-options.h
  111. qemu-options.hx
  112. qemu.nsi
  113. qemu.sasl
  114. README.rst
  115. replication.c
  116. replication.h
  117. thunk.c
  118. trace-events
  119. VERSION
  120. version.rc