1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
|
peripherals: 0.992
debug: 0.992
register: 0.991
arm: 0.990
risc-v: 0.990
hypervisor: 0.990
user-level: 0.990
semantic: 0.989
assembly: 0.989
device: 0.989
TCG: 0.989
VMM: 0.989
permissions: 0.988
boot: 0.988
architecture: 0.988
KVM: 0.988
vnc: 0.988
PID: 0.987
ppc: 0.987
socket: 0.987
performance: 0.987
x86: 0.986
kernel: 0.986
virtual: 0.985
graphic: 0.984
mistranslation: 0.984
network: 0.983
files: 0.982
i386: 0.974
CVE-2020-13253 QEMU: sd: OOB access could crash the guest resulting in DoS
An out-of-bounds read access issue was found in the SD Memory Card emulator of the QEMU. It occurs while performing block write commands via sdhci_write(), if a guest user has sent 'address' which is OOB of 's->wp_groups'. A guest user/process may use this flaw to crash the QEMU process resulting in DoS.
#!/bin/sh
cat << EOF > inp
outl 0xcf8 0x80001810
outl 0xcfc 0xe1068000
outl 0xcf8 0x80001814
outl 0xcf8 0x80001804
outw 0xcfc 0x7
outl 0xcf8 0x8000fa20
write 0xe106802c 0x1 0x6d
write 0xe106800f 0x1 0xf7
write 0xe106800a 0x6 0x9b4b9b5a9b69
write 0xe1068028 0x3 0x6d6d6d
write 0xe106800f 0x1 0x02
write 0xe1068005 0xb 0x055cfbffffff000000ff03
write 0xe106800c 0x1d 0x050bc6c6c6c6c6c6c6c6762e4c5e0bc603040000000000e10200110000
write 0xe1068003 0xd 0x2b6de02c3a6de02c496de02c58
EOF
../bin/qemu-system-x86_64 -qtest stdio -enable-kvm -monitor none \
-serial none -M pc-q35-5.0 -device sdhci-pci,sd-spec-version=3 \
-device sd-card,drive=mydrive -nographic \
-drive if=sd,index=0,file=null-co://,format=raw,id=mydrive < inp
This bug and the reproducer above is shared by - Alexander Bulekov <email address hidden>
Upstream patch thread
-> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05877.html
Patch reducing the exposure to this bug:
https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00823.html
Avoid OOB access by verifying the requested address belong to
the actual card size. Return ADDRESS_ERROR when not in range.
"SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"
4.3.4 Data Write
* Block Write
Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
occurred and no data transfer is performed.
Fixes: CVE-2020-13253
Reported-by: Alexander Bulekov <email address hidden>
Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
Signed-off-by: Philippe Mathieu-Daudé <email address hidden>
---
Cc: Prasad J Pandit <email address hidden>
---
hw/sd/sd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 3c06a0ac6d..0ced3b5e14 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1211,6 +1211,10 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
/* Writing in SPI mode not implemented. */
if (sd->spi)
break;
+ if (addr >= sd->size) {
+ sd->card_status |= ADDRESS_ERROR;
+ return sd_r1;
+ }
sd->state = sd_receivingdata_state;
sd->data_start = addr;
sd->data_offset = 0;
--
2.21.3
On 6/4/20 8:03 PM, Paolo Bonzini wrote:
> On 04/06/20 19:34, Philippe Mathieu-Daudé wrote:
>> Avoid OOB access by verifying the requested address belong to
>> the actual card size. Return ADDRESS_ERROR when not in range.
>>
>> "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"
>>
>> 4.3.4 Data Write
>>
>> * Block Write
>>
>> Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
>> occurred and no data transfer is performed.
>>
>> Fixes: CVE-2020-13253
>> Reported-by: Alexander Bulekov <email address hidden>
>> Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
>> Signed-off-by: Philippe Mathieu-Daudé <email address hidden>
>> ---
>> Cc: Prasad J Pandit <email address hidden>
>> ---
>> hw/sd/sd.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/hw/sd/sd.c b/hw/sd/sd.c
>> index 3c06a0ac6d..0ced3b5e14 100644
>> --- a/hw/sd/sd.c
>> +++ b/hw/sd/sd.c
>> @@ -1211,6 +1211,10 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
>> /* Writing in SPI mode not implemented. */
>> if (sd->spi)
>> break;
>> + if (addr >= sd->size) {
>> + sd->card_status |= ADDRESS_ERROR;
>> + return sd_r1;
>> + }
>> sd->state = sd_receivingdata_state;
>> sd->data_start = addr;
>> sd->data_offset = 0;
>>
>
> I'm not sure if you want me to queue it, but I did.
Hmm I guess I typed "^RPrasad" in my shell to have the last git-publish
command with his email, and I didn't noticed you were also there...
Anyway looking at it again, this patch is wrong because I should check
for addr + blksize < sd_size instead. Can you drop it please?
> Probably we should
> add <email address hidden> to the hw/sd stanza.
OK will do.
>
> Paolo
>
Avoid OOB access by verifying the requested address belong to
the actual card size. Return ADDRESS_ERROR when not in range.
Only move the state machine to ReceivingData if there is no
pending error.
"SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"
4.3.4 Data Write
* Block Write
Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
occurred and no data transfer is performed.
Fixes: CVE-2020-13253
Reported-by: Alexander Bulekov <email address hidden>
Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
Signed-off-by: Philippe Mathieu-Daudé <email address hidden>
---
Cc: Prasad J Pandit <email address hidden>
v2: check for blksz in range, only go to sd_receivingdata_state
if no error.
---
hw/sd/sd.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 3c06a0ac6d..2254dc7acc 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1211,17 +1211,18 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
/* Writing in SPI mode not implemented. */
if (sd->spi)
break;
- sd->state = sd_receivingdata_state;
- sd->data_start = addr;
- sd->data_offset = 0;
- sd->blk_written = 0;
-
- if (sd->data_start + sd->blk_len > sd->size)
+ if (addr + sd->blk_len >= sd->size) {
sd->card_status |= ADDRESS_ERROR;
- if (sd_wp_addr(sd, sd->data_start))
+ } else if (sd_wp_addr(sd, sd->data_start)) {
sd->card_status |= WP_VIOLATION;
- if (sd->csd[14] & 0x30)
+ } else if (sd->csd[14] & 0x30) {
sd->card_status |= WP_VIOLATION;
+ } else {
+ sd->state = sd_receivingdata_state;
+ sd->data_start = addr;
+ sd->data_offset = 0;
+ sd->blk_written = 0;
+ }
return sd_r1;
default:
--
2.21.3
On 6/4/20 8:25 PM, Philippe Mathieu-Daudé wrote:
> Avoid OOB access by verifying the requested address belong to
> the actual card size. Return ADDRESS_ERROR when not in range.
> Only move the state machine to ReceivingData if there is no
> pending error.
>
> "SD Specifications Part 1 Physical Layer Simplified Spec. v3.01"
>
> 4.3.4 Data Write
>
> * Block Write
>
> Write command is rejected if BLOCK_LEN_ERROR or ADDRESS_ERROR
> occurred and no data transfer is performed.
>
> Fixes: CVE-2020-13253
> Reported-by: Alexander Bulekov <email address hidden>
> Buglink: https://bugs.launchpad.net/qemu/+bug/1880822
While the reproducer triggers the OOB via CMD24, other commands have the
same problem, so I'll post a v3.
> Signed-off-by: Philippe Mathieu-Daudé <email address hidden>
> ---
> Cc: Prasad J Pandit <email address hidden>
>
> v2: check for blksz in range, only go to sd_receivingdata_state
> if no error.
> ---
> hw/sd/sd.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/hw/sd/sd.c b/hw/sd/sd.c
> index 3c06a0ac6d..2254dc7acc 100644
> --- a/hw/sd/sd.c
> +++ b/hw/sd/sd.c
> @@ -1211,17 +1211,18 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
> /* Writing in SPI mode not implemented. */
> if (sd->spi)
> break;
> - sd->state = sd_receivingdata_state;
> - sd->data_start = addr;
> - sd->data_offset = 0;
> - sd->blk_written = 0;
> -
> - if (sd->data_start + sd->blk_len > sd->size)
> + if (addr + sd->blk_len >= sd->size) {
> sd->card_status |= ADDRESS_ERROR;
> - if (sd_wp_addr(sd, sd->data_start))
> + } else if (sd_wp_addr(sd, sd->data_start)) {
> sd->card_status |= WP_VIOLATION;
> - if (sd->csd[14] & 0x30)
> + } else if (sd->csd[14] & 0x30) {
> sd->card_status |= WP_VIOLATION;
> + } else {
> + sd->state = sd_receivingdata_state;
> + sd->data_start = addr;
> + sd->data_offset = 0;
> + sd->blk_written = 0;
> + }
> return sd_r1;
>
> default:
>
v3:
https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg01316.html
Fixed in commit 790762e5487114341cccc5bffcec4cb3c022c3cd.
|