mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-08-26 22:23:12 -04:00
733a98a552
libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE and maps logs large enough based on this assumption. However, vduse_queue_enable() accepts the vq size returned through VDUSE_VQ_GET_INFO without validation, so a value above VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes out-of-bounds writes in vduse_queue_inflight_get(). According to the virtio spec, vq size can only be reduced, not increased, so vq size must not exceed the previously configured max_size, but the kernel vduse module does not validate this for us, and we should not trust another process to follow the spec. Validate and reject vq size values above VIRTQUEUE_MAX_SIZE. Fixes: CVE-2026-61402 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652 Reported-by: Jia Jia <physicalmtea@gmail.com> Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
|---|---|---|
| .. | ||
| include | ||
| linux-headers | ||
| standard-headers | ||
| libvduse.c | ||
| libvduse.h | ||
| meson.build | ||