Skip to content

Commit 48a737c

Browse files
committedNov 9, 2020
qemu: apply patch for CVE-2020-27617
An assert(3) failure issue was found in the networking helper functions of QEMU. It could occur in the eth_get_gso_type() routine, if a packet does not have a valid networking L3 protocol (ex. IPv4, IPv6) value. A guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario. Fixes: CVE-2020-27617 (cherry picked from commit 0c54b75)
1 parent 96052f3 commit 48a737c

File tree

2 files changed

+44
-0
lines changed

2 files changed

+44
-0
lines changed
 
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
From 6d19c0cc6c5a9bba308fc29d7c0edc2dc372c41b Mon Sep 17 00:00:00 2001
2+
From: Prasad J Pandit <pjp@fedoraproject.org>
3+
Date: Wed, 21 Oct 2020 11:35:50 +0530
4+
Subject: [PATCH] net: remove an assert call in eth_get_gso_type
5+
6+
eth_get_gso_type() routine returns segmentation offload type based on
7+
L3 protocol type. It calls g_assert_not_reached if L3 protocol is
8+
unknown, making the following return statement unreachable. Remove the
9+
g_assert call, it maybe triggered by a guest user.
10+
11+
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
12+
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
13+
---
14+
net/eth.c | 6 +++---
15+
1 file changed, 3 insertions(+), 3 deletions(-)
16+
17+
diff --git a/net/eth.c b/net/eth.c
18+
index 0c1d413ee2..eee77071f9 100644
19+
--- a/net/eth.c
20+
+++ b/net/eth.c
21+
@@ -16,6 +16,7 @@
22+
*/
23+
24+
#include "qemu/osdep.h"
25+
+#include "qemu/log.h"
26+
#include "net/eth.h"
27+
#include "net/checksum.h"
28+
#include "net/tap.h"
29+
@@ -71,9 +72,8 @@ eth_get_gso_type(uint16_t l3_proto, uint8_t *l3_hdr, uint8_t l4proto)
30+
return VIRTIO_NET_HDR_GSO_TCPV6 | ecn_state;
31+
}
32+
}
33+
-
34+
- /* Unsupported offload */
35+
- g_assert_not_reached();
36+
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: probably not GSO frame, "
37+
+ "unknown L3 protocol: 0x%04"PRIx16"\n", __func__, l3_proto);
38+
39+
return VIRTIO_NET_HDR_GSO_NONE | ecn_state;
40+
}
41+
--
42+
2.28.0
43+

‎pkgs/applications/virtualization/qemu/default.nix

+1
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
7979
./no-etc-install.patch
8080
./fix-qemu-ga.patch
8181
./9p-ignore-noatime.patch
82+
./CVE-2020-27617.patch
8283
] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
8384
++ optionals stdenv.hostPlatform.isMusl [
8485
(fetchpatch {

0 commit comments

Comments
 (0)