Commit ce48f2f4 authored by Kevin Wolf's avatar Kevin Wolf Committed by Stefan Hajnoczi
Browse files

qcow2: Validate snapshot table offset/size (CVE-2014-0144) 



This avoid unbounded memory allocation and fixes a potential buffer
overflow on 32 bit hosts.

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent 8c7de283

block/qcow2-snapshot.c

+4 −25
Original line number Diff line number Diff line
@@ -26,31 +26,6 @@ 
#include "block/block_int.h"

#include "block/qcow2.h"



typedef struct QEMU_PACKED QCowSnapshotHeader {

    /* header is 8 byte aligned */

    uint64_t l1_table_offset;



    uint32_t l1_size;

    uint16_t id_str_size;

    uint16_t name_size;



    uint32_t date_sec;

    uint32_t date_nsec;



    uint64_t vm_clock_nsec;



    uint32_t vm_state_size;

    uint32_t extra_data_size; /* for extension */

    /* extra data follows */

    /* id_str follows */

    /* name follows  */

} QCowSnapshotHeader;



typedef struct QEMU_PACKED QCowSnapshotExtraData {

    uint64_t vm_state_size_large;

    uint64_t disk_size;

} QCowSnapshotExtraData;



void qcow2_free_snapshots(BlockDriverState *bs)

{

    BDRVQcowState *s = bs->opaque;
@@ -357,6 +332,10 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info) 
    uint64_t *l1_table = NULL;

    int64_t l1_table_offset;



    if (s->nb_snapshots >= QCOW_MAX_SNAPSHOTS) {

        return -EFBIG;

    }



    memset(sn, 0, sizeof(*sn));



    /* Generate an ID if it wasn't passed */

block/qcow2.c

+15 −0
Original line number Diff line number Diff line
@@ -623,6 +623,21 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags, 
        goto fail;

    }



    /* Snapshot table offset/length */

    if (header.nb_snapshots > QCOW_MAX_SNAPSHOTS) {

        error_setg(errp, "Too many snapshots");

        ret = -EINVAL;

        goto fail;

    }



    ret = validate_table_offset(bs, header.snapshots_offset,

                                header.nb_snapshots,

                                sizeof(QCowSnapshotHeader));

    if (ret < 0) {

        error_setg(errp, "Invalid snapshot table offset");

        goto fail;

    }



    s->snapshots_offset = header.snapshots_offset;

    s->nb_snapshots = header.nb_snapshots;

block/qcow2.h

+28 −1
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ 
#define QCOW_CRYPT_AES  1



#define QCOW_MAX_CRYPT_CLUSTERS 32

#define QCOW_MAX_SNAPSHOTS 65536



/* indicate that the refcount of the referenced cluster is exactly one. */

#define QCOW_OFLAG_COPIED     (1ULL << 63)
@@ -97,6 +98,32 @@ typedef struct QCowHeader { 
    uint32_t header_length;

} QEMU_PACKED QCowHeader;



typedef struct QEMU_PACKED QCowSnapshotHeader {

    /* header is 8 byte aligned */

    uint64_t l1_table_offset;



    uint32_t l1_size;

    uint16_t id_str_size;

    uint16_t name_size;



    uint32_t date_sec;

    uint32_t date_nsec;



    uint64_t vm_clock_nsec;



    uint32_t vm_state_size;

    uint32_t extra_data_size; /* for extension */

    /* extra data follows */

    /* id_str follows */

    /* name follows  */

} QCowSnapshotHeader;



typedef struct QEMU_PACKED QCowSnapshotExtraData {

    uint64_t vm_state_size_large;

    uint64_t disk_size;

} QCowSnapshotExtraData;





typedef struct QCowSnapshot {

    uint64_t l1_table_offset;

    uint32_t l1_size;
@@ -202,7 +229,7 @@ typedef struct BDRVQcowState { 
    AES_KEY aes_decrypt_key;

    uint64_t snapshots_offset;

    int snapshots_size;

    int nb_snapshots;

    unsigned int nb_snapshots;

    QCowSnapshot *snapshots;



    int flags;

tests/qemu-iotests/080

+27 −0
Original line number Diff line number Diff line
@@ -47,6 +47,8 @@ header_size=104 
offset_backing_file_offset=8

offset_refcount_table_offset=48

offset_refcount_table_clusters=56

offset_nb_snapshots=60

offset_snapshots_offset=64

offset_header_size=100

offset_ext_magic=$header_size

offset_ext_size=$((header_size + 4))
@@ -90,6 +92,31 @@ poke_file "$TEST_IMG" "$offset_refcount_table_offset" "\xff\xff\xff\xff\xff\xff\ 
poke_file "$TEST_IMG" "$offset_refcount_table_clusters" "\x00\x00\x00\x7f"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



echo

echo "== Invalid snapshot table =="

_make_test_img 64M

poke_file "$TEST_IMG" "$offset_nb_snapshots" "\xff\xff\xff\xff"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir

poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x7f\xff\xff\xff"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



poke_file "$TEST_IMG" "$offset_snapshots_offset" "\xff\xff\xff\xff\xff\xff\x00\x00"

poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x00\x00\xff\xff"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



poke_file "$TEST_IMG" "$offset_snapshots_offset" "\x12\x34\x56\x78\x90\xab\xcd\xef"

poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x00\x00\x00\x00"

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



echo

echo "== Hitting snapshot table size limit =="

_make_test_img 64M

# Put the refcount table in a more or less safe place (16 MB)

poke_file "$TEST_IMG" "$offset_snapshots_offset" "\x00\x00\x00\x00\x01\x00\x00\x00"

poke_file "$TEST_IMG" "$offset_nb_snapshots" "\x00\x01\x00\x00"

{ $QEMU_IMG snapshot -c test $TEST_IMG; } 2>&1 | _filter_testdir

{ $QEMU_IO -c "read 0 512" $TEST_IMG; } 2>&1 | _filter_qemu_io | _filter_testdir



# success, all done

echo "*** done"

rm -f $seq.full

tests/qemu-iotests/080.out

+17 −0
Original line number Diff line number Diff line
@@ -30,4 +30,21 @@ no file open, try 'help open' 
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 

qemu-io: can't open device TEST_DIR/t.qcow2: Invalid reference count table offset

no file open, try 'help open'



== Invalid snapshot table ==

Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 

qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots

no file open, try 'help open'

qemu-io: can't open device TEST_DIR/t.qcow2: Too many snapshots

no file open, try 'help open'

qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset

no file open, try 'help open'

qemu-io: can't open device TEST_DIR/t.qcow2: Invalid snapshot table offset

no file open, try 'help open'



== Hitting snapshot table size limit ==

Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 

qemu-img: Could not create snapshot 'test': -27 (File too large)

read 512/512 bytes at offset 0

512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

*** done