mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7cfcc79b0a
qemu/hw/scsi
History
Thomas Huth 7cfcc79b0a hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] 
We are doing things like

    nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);

in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2023-09-25 18:25:03 +02:00
..
emulation.c scsi-generic: avoid invalid access to struct when emulating block limits 2018-11-06 21:35:06 +01:00
esp-pci.c bulk: Remove pointless QOM casts 2023-06-05 20:48:34 +02:00
esp.c Fix several typos in documentation (found by codespell) 2022-11-11 09:39:25 +01:00
Kconfig hw/scsi: Introduce VHOST_SCSI_COMMON symbol in Kconfig 2023-06-23 02:54:44 -04:00
lsi53c895a.c hw/other: spelling fixes 2023-09-21 11:31:16 +03:00
megasas.c hw/scsi/megasas: Silent GCC duplicated-cond warning 2023-06-13 11:28:58 +02:00
meson.build hw/virtio: Build various target-agnostic objects just once 2023-06-23 02:54:44 -04:00
mfi.h hw/other: spelling fixes 2023-09-21 11:31:16 +03:00
mpi.h hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
mptconfig.c nomaintainer: Fix Lesser GPL version number 2020-11-15 17:04:40 +01:00
mptendian.c nomaintainer: Fix Lesser GPL version number 2020-11-15 17:04:40 +01:00
mptsas.c hw: replace most qemu_bh_new calls with qemu_bh_new_guarded 2023-04-28 11:31:54 +02:00
mptsas.h include/hw/pci: Split pci_device.h off pci.h 2023-01-08 01:54:22 -05:00
scsi-bus.c scsi: clear unit attention only for REPORT LUNS commands 2023-07-14 11:10:58 +02:00
scsi-disk.c hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] 2023-09-25 18:25:03 +02:00
scsi-generic.c scsi-generic: fix buffer overflow on block limits inquiry 2023-05-18 08:53:51 +02:00
spapr_vscsi.c scsi: Use device_cold_reset() and bus_cold_reset() 2022-10-18 13:58:04 +02:00
srp.h spapr-vscsi: add task management 2013-09-12 08:46:21 +02:00
trace-events virtio-scsi: implement BlockDevOps->drained_begin() 2023-05-30 17:32:02 +02:00
trace.h trace: switch position of headers to what Meson requires 2020-08-21 06:18:24 -04:00
vhost-scsi-common.c vhost-scsi: fix memleak of vsc->inflight 2023-01-08 01:54:23 -05:00
vhost-scsi.c hw/virtio: Remove unnecessary 'virtio-access.h' header 2023-06-23 02:54:44 -04:00
vhost-user-scsi.c hw/virtio: Remove unnecessary 'virtio-access.h' header 2023-06-23 02:54:44 -04:00
viosrp.h Updated the FSF address to <https://www.gnu.org/licenses/> 2023-02-27 09:15:39 +01:00
virtio-scsi-dataplane.c hw/virtio: Remove unnecessary 'virtio-access.h' header 2023-06-23 02:54:44 -04:00
virtio-scsi.c virtio-scsi: avoid dangling host notifier in ->ioeventfd_stop() 2023-06-26 09:50:00 -04:00
vmw_pvscsi.c hw: replace most qemu_bh_new calls with qemu_bh_new_guarded 2023-04-28 11:31:54 +02:00
vmw_pvscsi.h scsi: VMWare PVSCSI paravirtual device implementation 2013-04-19 10:44:17 +02:00