From nobody Mon Sep 30 12:01:49 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XHKRx2L43z5YBr7; Mon, 30 Sep 2024 12:01:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XHKRx1ZJBz4GG0; Mon, 30 Sep 2024 12:01:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1727697709; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gPwSeq4YgExJSf0hh+DLHQsfQwTYOBgc5tmnGcEdFl0=; b=IT2tGMG/mbONHBOjwofaAutil/jX+/Gn14133yM1ODO7/1t4aqKK40IPaffAMA0MsZ9iS4 FDMTYjUgXLOQ/olanq1DqgqctcCOTwgJXUooff0bd5x2YslbgQgW/F5ibaUVOuiQ3Uymv1 HQdTtqd88rqoopEZhuHczbRv+EoVrMOTgWdo36BimyJHcOnzk64eWUSqpynp6nuleLoTnp uzL11512qOFCtOybDw8AREPxjDu7r/EQPQy718I0WykdbUGHd0DNiPSFPQHSxTiPz/7MGu NqJIXUCIBUVHjgw1N8QWhSxKA/yRnUlw45Y+AtobkF1qqIfvloiRBN4KAwHtEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1727697709; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gPwSeq4YgExJSf0hh+DLHQsfQwTYOBgc5tmnGcEdFl0=; b=nutmI097/PZrdyBLcCXGfciiCzdTpIh8QByeOpozIcETJgfG7SXCBETdGSMZ3eP3Y/0Tda 7DFEJ33IE78YXd1Lb3evbUdH1o4+b6MImm6VmJcNLhNbNnw8cUxtNQe12/dhdgJtAkIUZu V+QcFZbf7kj4VgYZgViYWcDAs1C2YJvbSmhy1o+0n0QbGFP4aLLM8/ygVFLnuTKSvVjo/S 1bqYPEgwabfJqRHvneF5xppiU0bT1sVwi+riN0TyHlXwnbkmv852413CmC0eee2QTrV6D+ 27nu8veRMa3vJ40FnMiil8ILZa0L3BCzR1e3de+ma/azGhxsp3lu5deZPFc7Uw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1727697709; a=rsa-sha256; cv=none; b=uos6IF87M4LmDDe7y/LcoyD9L2B/bMW87eQ1XD/Az1i4qKlp0QMukCLCRumKQXcQ9iP4VU EE3XPM36XPZreAWosO5Kw7VMt7myTmRXTn25fGjR87yUt+PiOspJM5V7z9KOCQau9BjqIW 5VKuKK/41U0ir6u1vY9ULdQowcZX7eA1AmqmS3aBOJ7EldTpEPYa9tHmFz+V+gLD5FiMor 2Vyp/T0UEWLwoQrJObe4Rj/7kyxJf4CgPTNj4FHoFqlXf2jKjNtIM55nXZe4yduldQHZwl ZcJYlXDaEq7J0mPgmDsNgloFJnBp1EfOLFgJ5IDZvFkeDYcrVOBiyVS7lroBZA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4XHKRx19TYzsHC; Mon, 30 Sep 2024 12:01:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 48UC1nXi033224; Mon, 30 Sep 2024 12:01:49 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 48UC1n0V033221; Mon, 30 Sep 2024 12:01:49 GMT (envelope-from git) Date: Mon, 30 Sep 2024 12:01:49 GMT Message-Id: <202409301201.48UC1n0V033221@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: 8934002959e0 - main - bhyve: avoid buffer overflow in pci_vtcon_control_send List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8934002959e02bcf5e3262730c3a731af95afb15 Auto-Submitted: auto-generated The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=8934002959e02bcf5e3262730c3a731af95afb15 commit 8934002959e02bcf5e3262730c3a731af95afb15 Author: Pierre Pronchery AuthorDate: 2024-07-24 18:23:12 +0000 Commit: Ed Maste CommitDate: 2024-09-30 12:01:28 +0000 bhyve: avoid buffer overflow in pci_vtcon_control_send The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Inside the function pci_vtcon_control_send, the length of the iov buffer is not validated before copy of the payload. Reported by: Synacktiv Reviewed by: markj Security: HYP-19 Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46105 --- usr.sbin/bhyve/pci_virtio_console.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/usr.sbin/bhyve/pci_virtio_console.c b/usr.sbin/bhyve/pci_virtio_console.c index 921cb29032cf..4b957322b395 100644 --- a/usr.sbin/bhyve/pci_virtio_console.c +++ b/usr.sbin/bhyve/pci_virtio_console.c @@ -580,11 +580,15 @@ pci_vtcon_control_send(struct pci_vtcon_softc *sc, n = vq_getchain(vq, &iov, 1, &req); assert(n == 1); + if (iov.iov_len < sizeof(struct pci_vtcon_control)) + goto out; + memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control)); if (payload != NULL && len > 0) memcpy((uint8_t *)iov.iov_base + sizeof(struct pci_vtcon_control), payload, len); +out: vq_relchain(vq, req.idx, sizeof(struct pci_vtcon_control) + len); vq_endchains(vq, 1); }