mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 09:55:55 +00:00
hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
We are doing things like nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE); in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes with a division by 0 exception. Thus disallow block sizes of 256 bytes to avoid this situation. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813 CVE: 2023-42467 Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20230925091854.49198-1-thuth@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
8a9fc82bac
commit
7cfcc79b0a
|
@ -1628,9 +1628,10 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
|
|||
* Since the existing code only checks/updates bits 8-15 of the block
|
||||
* size, restrict ourselves to the same requirement for now to ensure
|
||||
* that a block size set by a block descriptor and then read back by
|
||||
* a subsequent SCSI command will be the same
|
||||
* a subsequent SCSI command will be the same. Also disallow a block
|
||||
* size of 256 since we cannot handle anything below BDRV_SECTOR_SIZE.
|
||||
*/
|
||||
if (bs && !(bs & ~0xff00) && bs != s->qdev.blocksize) {
|
||||
if (bs && !(bs & ~0xfe00) && bs != s->qdev.blocksize) {
|
||||
s->qdev.blocksize = bs;
|
||||
trace_scsi_disk_mode_select_set_blocksize(s->qdev.blocksize);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue