1 files changed, 26 insertions, 0 deletions

diff --git a/gitlab/issues/target_missing/host_missing/accel_missing/646.toml b/gitlab/issues/target_missing/host_missing/accel_missing/646.toml
new file mode 100644
index 00000000..b47e7f9a
--- /dev/null
+++ b/gitlab/issues/target_missing/host_missing/accel_missing/646.toml
@@ -0,0 +1,26 @@
+id = 646
+title = "Infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c (CVE-2020-14394)"
+state = "closed"
+created_at = "2021-09-28T12:49:47.888Z"
+closed_at = "2022-08-16T18:23:56.604Z"
+labels = ["Security", "TestCase", "USB", "workflow::In Progress"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/646"
+host-os = "Fedora 33"
+host-arch = "x86"
+qemu-version = "6.1.50 (v6.1.0-861-g22651bced7)"
+guest-os = "Fedora 32"
+guest-arch = "x86"
+description = """An infinite loop issue was found in the USB xHCI controller emulation of QEMU. Specifically, function `xhci_ring_chain_length()` in hw/usb/hcd-xhci.c may get stuck while fetching empty TRBs from guest memory, since the exit conditions of the loop depend on values that are fully controlled by guest. A privileged guest user may exploit this issue to hang the QEMU process on the host, resulting in a denial of service."""
+reproduce = """Build and load `xhci.ko` from within the guest:
+
+1) make
+2) insmod xhci.ko
+
+[Makefile](/uploads/98dbf7b4facc9b100817b3c8f63b5cb2/Makefile)
+
+[usb-xhci.h](/uploads/f225524b1553d8cf6c1dfa89369b6edc/usb-xhci.h)
+
+[xhci.c](/uploads/c635f742d12a2bba6ea472ddfe006d56/xhci.c)"""
+additional = """This issue was reported by Gaoning Pan (Zhejiang University) and Xingwei Li (Ant Security Light-Year Lab).
+
+RH bug: https://bugzilla.redhat.com/show_bug.cgi?id=1908004."""