add 18th iteration of classifier

1 files changed, 173 insertions, 0 deletions

diff --git a/results/classifier/118/all/1844635 b/results/classifier/118/all/1844635
new file mode 100644
index 00000000..0bdf556b
--- /dev/null
+++ b/results/classifier/118/all/1844635
@@ -0,0 +1,173 @@
+debug: 0.989
+semantic: 0.988
+performance: 0.986
+architecture: 0.985
+register: 0.984
+assembly: 0.984
+graphic: 0.984
+permissions: 0.984
+kernel: 0.983
+virtual: 0.982
+peripherals: 0.982
+device: 0.981
+arm: 0.980
+boot: 0.980
+PID: 0.978
+hypervisor: 0.976
+risc-v: 0.976
+socket: 0.975
+network: 0.975
+vnc: 0.974
+user-level: 0.974
+files: 0.973
+TCG: 0.971
+VMM: 0.971
+KVM: 0.968
+x86: 0.966
+ppc: 0.965
+mistranslation: 0.960
+i386: 0.956
+
+qemu bug where load linux kernel
+
+i found a qemu bug ,when the qemu start and parse the kernel file .
+
+This vulnerability can be exploited.
+
+thanks
+
+/****
+
+
+(gdb) set args -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -m 2048  -smp 2 -cpu host -machine kernel_irqchip=split -kernel poc1
+(gdb) r
+Starting program: /usr/bin/qemu-system-x86_64 -nodefaults -device pc-testdev -device isa-debug-exit,iobase=0xf4,iosize=0x4 -vnc none -serial stdio -device pci-testdev -machine accel=kvm -m 2048  -smp 2 -cpu host -machine kernel_irqchip=split -kernel ./poc/poc1
+[Thread debugging using libthread_db enabled]
+Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
+[New Thread 0x7fffe9a03700 (LWP 30066)]
+[New Thread 0x7fffe9202700 (LWP 30068)]
+[New Thread 0x7fffe8a01700 (LWP 30069)]
+
+Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
+__memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:249
+249	../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory.
+(gdb) bt
+#0  0x00007ffff2390b1f in __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:249
+#1  0x00005555559ebdcf in rom_copy ()
+#2  0x00005555558dd1b3 in load_multiboot ()
+#3  0x00005555558de1c3 in  ()
+#4  0x00005555558e19d1 in pc_memory_init ()
+#5  0x00005555558e4ee3 in  ()
+#6  0x00005555559e8500 in machine_run_board_init ()
+#7  0x0000555555834959 in main ()
+(gdb) c
+Continuing.
+Couldn't get registers: No such process.
+Couldn't get registers: No such process.
+(gdb) [Thread 0x7fffe8a01700 (LWP 30069) exited]
+[Thread 0x7fffe9202700 (LWP 30068) exited]
+[Thread 0x7fffe9a03700 (LWP 30066) exited]
+
+Program terminated with signal SIGSEGV, Segmentation fault.
+The program no longer exists.
+
+***/
+
+
+
+bug reason and how to fix it
+/*
+ * Copies memory from registered ROMs to dest. Any memory that is contained in
+ * a ROM between addr and addr + size is copied. Note that this can involve
+ * multiple ROMs, which need not start at addr and need not end at addr + size.
+ */
+int rom_copy(uint8_t *dest, hwaddr addr, size_t size)
+{
+    hwaddr end = addr + size;
+    uint8_t *s, *d = dest;
+    size_t l = 0;
+    Rom *rom;
+
+    QTAILQ_FOREACH(rom, &roms, next) {
+        if (rom->fw_file) {
+            continue;
+        }
+        if (rom->mr) {
+            continue;
+        }
+        if (rom->addr + rom->romsize < addr) {
+            continue;
+        }
+        if (rom->addr > end) {
+            break;
+        }
+
+        d = dest + (rom->addr - addr);
+        s = rom->data;
+        l = rom->datasize;
+
+        if ((d + l) > (dest + size)) {
+            l = dest - d;
+        }
+
+        if (l > 0) {
+            memcpy(d, s, l);  //*****crash here  how to fix check the size l.******//
+        }
+
+        if (rom->romsize > rom->datasize) {
+            /* If datasize is less than romsize, it means that we didn't
+             * allocate all the ROM because the trailing data are only zeros.
+             */
+
+            d += l;
+            l = rom->romsize - rom->datasize;
+
+            if ((d + l) > (dest + size)) {
+                /* Rom size doesn't fit in the destination area. Adjust to avoid
+                 * overflow.
+                 */
+                l = dest - d;
+            }
+
+            if (l > 0) {
+                memset(d, 0x0, l);
+            }
+        }
+    }
+
+    return (d + l) - dest;
+}
+
+I can't reproduce the issue with your "poc" binary here. Which version of QEMU were you exactly using? Can you reproduce it with the latest version from the master branch?
+
+Also there is already a size check some lines earlier:
+
+        if ((d + l) > (dest + size)) {
+            l = dest - d;
+        }
+
+Isn't that sufficient?
+
+Also please explain how this vulnerability could be exploited? The code patch is not triggered by the guest, is it?
+
+hi ,
+
+        if ((d + l) > (dest + size)) {
+            l = dest - d;
+        }
+the l will be a very big Unsigned number.
+ 
+the check was bypassed,try the new poc . i  reproduce it with the latest
+version on ubuntu . (apt install qemu , i got the latest version)
+
+hi Thomas,please try the new poc.
+thanks 
+
+Thanks a lot! With the new poc, I was able to reproduce the crash.
+I've forwarded the information to the QEMU security team (next time, it would be great if you could do that directly, see https://wiki.qemu.org/SecurityProcess for details), and after some discussion about the severity of the bug, I've now posted a patch to the mailing:
+
+ https://lists.gnu.org/archive/html/qemu-devel/2019-09/msg05960.html
+
+Fix has been merged:
+https://git.qemu.org/?p=qemu.git;a=commitdiff;h=e423455c4f23a1a8
+