diff options
| author | Peter Maydell | 2020-07-15 10:06:55 +0200 |
|---|---|---|
| committer | Peter Maydell | 2020-07-15 10:06:55 +0200 |
| commit | 3a9163af4e3dd61795a35d47b702e302f98f81d6 (patch) | |
| tree | b88eed6621df1f1f23c1f1233a9c8e1b0a3c72ff /MAINTAINERS | |
| parent | Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2020-07-13-tag' in... (diff) | |
| parent | hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (diff) | |
| download | qemu-3a9163af4e3dd61795a35d47b702e302f98f81d6.tar.gz qemu-3a9163af4e3dd61795a35d47b702e302f98f81d6.tar.xz qemu-3a9163af4e3dd61795a35d47b702e302f98f81d6.zip | |
Merge remote-tracking branch 'remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request' into staging
Fix CVE-2020-13253
By using invalidated address, guest can do out-of-bounds accesses.
These patches fix the issue by only allowing SD card image sizes
power of 2, and not switching to SEND_DATA state when the address
is invalid (out of range).
This issue was found using QEMU fuzzing mode (using --enable-fuzzing,
see docs/devel/fuzzing.txt) and reported by Alexander Bulekov.
Reproducer:
https://bugs.launchpad.net/qemu/+bug/1880822/comments/1
CI jobs results:
. https://cirrus-ci.com/build/5157142548185088
. https://gitlab.com/philmd/qemu/-/pipelines/166381731
. https://travis-ci.org/github/philmd/qemu/builds/707956535
# gpg: Signature made Tue 14 Jul 2020 14:54:44 BST
# gpg: using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD 6BB2 E3E3 2C2C DEAD C0DE
* remotes/philmd-gitlab/tags/sdcard-CVE-2020-13253-pull-request:
hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
hw/sd/sdcard: Update coding style to make checkpatch.pl happy
hw/sd/sdcard: Do not allow invalid SD card sizes
hw/sd/sdcard: Simplify realize() a bit
hw/sd/sdcard: Restrict Class 6 commands to SCSD cards
tests/acceptance/boot_linux: Expand SD card image to power of 2
tests/acceptance/boot_linux: Tag tests using a SD card with 'device:sd'
docs/orangepi: Add instructions for resizing SD image to power of two
MAINTAINERS: Cc qemu-block mailing list
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'MAINTAINERS')
| -rw-r--r-- | MAINTAINERS | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/MAINTAINERS b/MAINTAINERS index 80fa8837e9..310082fdc9 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1674,6 +1674,7 @@ F: hw/ssi/xilinx_* SD (Secure Card) M: Philippe Mathieu-Daudé <f4bug@amsat.org> +L: qemu-block@nongnu.org S: Odd Fixes F: include/hw/sd/sd* F: hw/sd/core.c |