mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-08-26 22:23:12 -04:00
733a98a552
libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE and maps logs large enough based on this assumption. However, vduse_queue_enable() accepts the vq size returned through VDUSE_VQ_GET_INFO without validation, so a value above VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes out-of-bounds writes in vduse_queue_inflight_get(). According to the virtio spec, vq size can only be reduced, not increased, so vq size must not exceed the previously configured max_size, but the kernel vduse module does not validate this for us, and we should not trust another process to follow the spec. Validate and reject vq size values above VIRTQUEUE_MAX_SIZE. Fixes: CVE-2026-61402 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652 Reported-by: Jia Jia <physicalmtea@gmail.com> Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git.mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> |
||
|---|---|---|
| .. | ||
| libvduse | ||
| libvhost-user | ||
| packagefiles | ||
| .gitignore | ||
| anyhow-1-rs.wrap | ||
| arbitrary-int-1-rs.wrap | ||
| attrs-0.2-rs.wrap | ||
| berkeley-softfloat-3.wrap | ||
| berkeley-testfloat-3.wrap | ||
| bilge-0.2-rs.wrap | ||
| bilge-impl-0.2-rs.wrap | ||
| dtc.wrap | ||
| either-1-rs.wrap | ||
| foreign-0.3-rs.wrap | ||
| glib-sys-0.21-rs.wrap | ||
| itertools-0.11-rs.wrap | ||
| keycodemapdb.wrap | ||
| libblkio.wrap | ||
| libc-0.2-rs.wrap | ||
| libvfio-user.wrap | ||
| probe-0.5-rs.wrap | ||
| proc-macro-error-1-rs.wrap | ||
| proc-macro-error-attr-1-rs.wrap | ||
| proc-macro2-1-rs.wrap | ||
| quote-1-rs.wrap | ||
| slirp.wrap | ||
| syn-2-rs.wrap | ||
| unicode-ident-1-rs.wrap | ||