[0/2] hw/sd/sdcard: Fix CVE-2020-13253 (Do not allow invalid SD card sizes)

Message ID	20200707132116.26207-1-f4bug@amsat.org
Headers	show Return-Path: <SRS0=B5/Q=AS=nongnu.org=qemu-devel-bounces+qemu-devel=archiver.kernel.org@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D399520771 From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <f4bug@amsat.org> To: qemu-devel@nongnu.org Subject: [PATCH 0/2] hw/sd/sdcard: Fix CVE-2020-13253 (Do not allow invalid SD card sizes) Date: Tue, 7 Jul 2020 15:21:14 +0200 Message-Id: <20200707132116.26207-1-f4bug@amsat.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2a00:1450:4864:20::42e; envelope-from=philippe.mathieu.daude@gmail.com; helo=mail-wr1-x42e.google.com Precedence: list Cc: Peter Maydell <peter.maydell@linaro.org>, qemu-block@nongnu.org, Alistair Francis <alistair@alistair23.me>, =?utf-8?q?Philippe_Mathieu?= =?utf-8?q?-Daud=C3=A9?= <f4bug@amsat.org>, Wainer dos Santos Moschetta <wainersm@redhat.com>, Niek Linnenbank <nieklinnenbank@gmail.com>, Cleber Rosa <crosa@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@redhat.com> Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" <qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org>
Series	hw/sd/sdcard: Fix CVE-2020-13253 (Do not allow invalid SD card sizes) \| expand [0/2] hw/sd/sdcard: Fix CVE-2020-13253 (Do not allow invalid SD card sizes) [2/2] hw/sd/sdcard: Do not allow invalid SD card sizes

Message ID

20200707132116.26207-1-f4bug@amsat.org

Headers

DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D399520771
From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <f4bug@amsat.org>
To: qemu-devel@nongnu.org
Subject: [PATCH 0/2] hw/sd/sdcard: Fix CVE-2020-13253 (Do not allow invalid
	SD card sizes)
Date: Tue,  7 Jul 2020 15:21:14 +0200
Message-Id: <20200707132116.26207-1-f4bug@amsat.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=2a00:1450:4864:20::42e;
	envelope-from=philippe.mathieu.daude@gmail.com;
	helo=mail-wr1-x42e.google.com
X-Spam_score_int: 0
X-Spam_score: 0.0
X-Spam_bar: /
X-Spam_report: (0.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
	DKIM_VALID=-0.1, 
	DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_FROMDOMAIN=1, FREEMAIL_FROM=0.001,
	HEADER_FROM_DIFFERENT_DOMAINS=1, RCVD_IN_DNSWL_NONE=-0.0001,
	SPF_HELO_NONE=0.001, SPF_PASS=-0.001,
	URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN
X-Spam_action: no action
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Cc: Peter Maydell <peter.maydell@linaro.org>, qemu-block@nongnu.org,
	Alistair Francis <alistair@alistair23.me>, =?utf-8?q?Philippe_Mathieu?=
	=?utf-8?q?-Daud=C3=A9?= <f4bug@amsat.org>,
	Wainer dos Santos Moschetta <wainersm@redhat.com>, Niek Linnenbank
	<nieklinnenbank@gmail.com>, Cleber Rosa <crosa@redhat.com>, Paolo
	Bonzini <pbonzini@redhat.com>, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?=
	<philmd@redhat.com>
Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org
Sender: "Qemu-devel"
	<qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org>

Series

hw/sd/sdcard: Fix CVE-2020-13253 (Do not allow invalid SD card sizes) | expand

Message

Philippe Mathieu-Daudé July 7, 2020, 1:21 p.m. UTC

Part 1 is already reviewed:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg718150.html

However the CVE fix break Linux guests:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg720737.html

This series fixes that, by checking the SD card image size is
correct.

Based-on: <20200630133912.9428-1-f4bug@amsat.org>

Philippe Mathieu-Daudé (2):
  tests/acceptance/boot_linux: Truncate SD card image to power of 2
  hw/sd/sdcard: Do not allow invalid SD card sizes

 hw/sd/sd.c                             | 16 ++++++++++++++++
 tests/acceptance/boot_linux_console.py | 15 +++++++++++++++
 2 files changed, 31 insertions(+)