mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-08-26 22:23:12 -04:00
bac345a99d
libvduse assumes that vq size (aka vq num) is below VIRTQUEUE_MAX_SIZE
and maps logs large enough based on this assumption.
However, vduse_queue_enable() accepts the vq size returned through
VDUSE_VQ_GET_INFO without validation, so a value above
VIRTQUEUE_MAX_SIZE (1024) overruns the inflight log and causes
out-of-bounds writes in vduse_queue_inflight_get().
According to the virtio spec, vq size can only be reduced, not
increased, so vq size must not exceed the previously configured
max_size, but the kernel vduse module does not validate this for us, and
we should not trust another process to follow the spec.
Validate and reject vq size values above VIRTQUEUE_MAX_SIZE.
Fixes: CVE-2026-61402
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3652
Reported-by: Jia Jia <physicalmtea@gmail.com>
Message-ID: <bf7e71b3139875e5e00fd53970c772d6c90dc2a1.1784888961.git.mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| libvduse | ||
| libvhost-user | ||
| packagefiles | ||
| .gitignore | ||
| arbitrary-int-1-rs.wrap | ||
| berkeley-softfloat-3.wrap | ||
| berkeley-testfloat-3.wrap | ||
| bilge-0.2-rs.wrap | ||
| bilge-impl-0.2-rs.wrap | ||
| dtc.wrap | ||
| either-1-rs.wrap | ||
| itertools-0.11-rs.wrap | ||
| keycodemapdb.wrap | ||
| libblkio.wrap | ||
| libc-0.2-rs.wrap | ||
| libvfio-user.wrap | ||
| proc-macro-error-1-rs.wrap | ||
| proc-macro-error-attr-1-rs.wrap | ||
| proc-macro2-1-rs.wrap | ||
| quote-1-rs.wrap | ||
| slirp.wrap | ||
| syn-2-rs.wrap | ||
| unicode-ident-1-rs.wrap | ||