| From 7cfcc79b0ab800959716738aff9419f53fc68c9c Mon Sep 17 00:00:00 2001 |
| From: Thomas Huth <thuth@redhat.com> |
| Date: Thu, 5 Oct 2023 06:01:10 +0000 |
| Subject: [PATCH] hw/scsi/scsi-disk: Disallow block sizes smaller than 512 |
| [CVE-2023-42467] |
| |
| We are doing things like |
| |
| nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE); |
| |
| in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if |
| the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes |
| with a division by 0 exception. Thus disallow block sizes of 256 |
| bytes to avoid this situation. |
| |
| Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813 |
| CVE: 2023-42467 |
| Signed-off-by: Thomas Huth <thuth@redhat.com> |
| Message-ID: <20230925091854.49198-1-thuth@redhat.com> |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| |
| CVE: CVE-2023-42467 |
| |
| Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c] |
| |
| Signed-off-by: Yogita Urade <yogita.urade@windriver.com> |
| --- |
| hw/scsi/scsi-disk.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c |
| index e0d79c796..477ee2bcd 100644 |
| --- a/hw/scsi/scsi-disk.c |
| +++ b/hw/scsi/scsi-disk.c |
| @@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) |
| * Since the existing code only checks/updates bits 8-15 of the block |
| * size, restrict ourselves to the same requirement for now to ensure |
| * that a block size set by a block descriptor and then read back by |
| - * a subsequent SCSI command will be the same |
| + * a subsequent SCSI command will be the same. Also disallow a block |
| + * size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE. |
| */ |
| - if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) { |
| + if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) { |
| s->qdev.blocksize = bs; |
| trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize); |
| } |
| -- |
| 2.40.0 |