mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

usbredir: patch CVE-2021-3700

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3700

Pick the patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Gyorgy Sarvari
2025-11-14 20:45:21 +01:00
parent eeda504ce9
commit b5a19849c5
2 changed files with 77 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/spice/usbredir/CVE-2021-3700.patch
+74
View File
@@ -0,0 +1,74 @@
From 4851f8d4538e0a25992619ad96a2366c1632e46e Mon Sep 17 00:00:00 2001
From: Michael Hanselmann <public@hansmi.ch>
Date: Sun, 8 Aug 2021 15:35:58 +0200
Subject: [PATCH] Avoid use-after-free in serialization
Serializing parsers with large amounts of buffered write data (e.g. in case of
a slow or blocked write destination) would cause "serialize_data" to reallocate
the state buffer whose default size is 64kB (USBREDIRPARSER_SERIALIZE_BUF_SIZE).
The pointer to the position for the write buffer count would then point to
a location outside the buffer where the number of write buffers would be written
as a 32-bit value.
As of QEMU 5.2.0 the serializer is invoked for migrations. Serializations for
migrations may happen regularily such as when using the COLO feature[1].
Serialization happens under QEMU's I/O lock. The guest can't control the state
while the serialization is happening. The value written is the number of
outstanding buffers which would be suceptible to timing and host system system
load. The guest would have to continously groom the write buffers. A useful
value needs to be allocated in the exact position freed during the buffer size
increase, but before the buffer count is written. The author doesn't consider it
realistic to exploit this use-after-free reliably.
[1] https://wiki.qemu.org/Features/COLO
Signed-off-by: Michael Hanselmann <public@hansmi.ch>
CVE: CVE-2021-3700
Upstream-Status: Backport [https://gitlab.freedesktop.org/spice/usbredir/-/commit/03c519ff5831ba]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
usbredirparser/usbredirparser.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/usbredirparser/usbredirparser.c b/usbredirparser/usbredirparser.c
index ba8edb4..ccd3078 100644
--- a/usbredirparser/usbredirparser.c
+++ b/usbredirparser/usbredirparser.c
@@ -20,6 +20,7 @@
*/
#include "config.h"
+#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
@@ -1594,8 +1595,9 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
struct usbredirparser_priv *parser =
(struct usbredirparser_priv *)parser_pub;
struct usbredirparser_buf *wbuf;
- uint8_t *write_buf_count_pos, *state = NULL, *pos = NULL;
+ uint8_t *state = NULL, *pos = NULL;
uint32_t write_buf_count = 0, len, remain = 0;
+ ptrdiff_t write_buf_count_pos;
*state_dest = NULL;
*state_len = 0;
@@ -1640,7 +1642,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
parser->data, parser->data_read, "packet-data"))
return -1;
- write_buf_count_pos = pos;
+ write_buf_count_pos = pos - state;
/* To be replaced with write_buf_count later */
if (serialize_int(parser, &state, &pos, &remain, 0, "write_buf_count"))
return -1;
@@ -1655,7 +1657,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
wbuf = wbuf->next;
}
/* Patch in write_buf_count */
- memcpy(write_buf_count_pos, &write_buf_count, sizeof(int32_t));
+ memcpy(state + write_buf_count_pos, &write_buf_count, sizeof(int32_t));
/* Patch in length */
len = pos - state;
meta-networking/recipes-support/spice/usbredir_0.9.0.bb
+3 -1
View File
@@ -9,7 +9,9 @@ DEPENDS = "libusb1"
SRCREV = "bca484fc6f206ab9da2f73e8a0118fad45374d4e"
SRC_URI = "git://gitlab.freedesktop.org/spice/usbredir;branch=main;protocol=https"
SRC_URI = "git://gitlab.freedesktop.org/spice/usbredir;branch=main;protocol=https \
file://CVE-2021-3700.patch \
"
S = "${WORKDIR}/git"