mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-08-26 22:23:12 -04:00
6a4def76fb
rng_backend_request_entropy() uses the requested size to allocate a buffer with g_malloc(). With virtio-rng, this size comes from guest-supplied descriptor lengths. A malicious guest can set a very large descriptor length, causing QEMU to attempt a multi-gigabyte allocation and abort. Cap the allocation to 64 KiB. The virtio-rng queue size is hardcoded to 8 entries, the EGD backend protocol limits requests to 255 bytes, the Linux kernel hwrng framework requests at most SMP_CACHE_BYTES per call (64 bytes on x86_64), and the Windows viorng driver uses a 4 KiB buffer. The worst legitimate case is 8 x 4 KiB = 32 KiB, so 64 KiB is well above any legitimate use. Fixes: |
||
|---|---|---|
| .. | ||
| tpm | ||
| confidential-guest-support.c | ||
| cryptodev-builtin.c | ||
| cryptodev-hmp-cmds.c | ||
| cryptodev-lkcf.c | ||
| cryptodev-vhost-user.c | ||
| cryptodev-vhost.c | ||
| cryptodev.c | ||
| dbus-vmstate.c | ||
| dbus-vmstate1.xml | ||
| host_iommu_device.c | ||
| hostmem-epc.c | ||
| hostmem-file.c | ||
| hostmem-memfd.c | ||
| hostmem-ram.c | ||
| hostmem-shm.c | ||
| hostmem.c | ||
| iommufd.c | ||
| Kconfig | ||
| meson.build | ||
| rng-builtin.c | ||
| rng-egd.c | ||
| rng-random.c | ||
| rng.c | ||
| spdm-socket.c | ||
| trace-events | ||
| trace.h | ||
| vhost-user.c | ||