087e70498a
Fixes the following security issues:
CVE-2016-9577
Frediano Ziglio of Red Hat discovered a buffer overflow
vulnerability in the main_channel_alloc_msg_rcv_buf function. An
authenticated attacker can take advantage of this flaw to cause a
denial of service (spice server crash), or possibly, execute
arbitrary code.
CVE-2016-9578
Frediano Ziglio of Red Hat discovered that spice does not properly
validate incoming messages. An attacker able to connect to the
spice server could send crafted messages which would cause the
process to crash.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
44 lines
1.7 KiB
Diff
44 lines
1.7 KiB
Diff
From f66dc643635518e53dfbe5262f814a64eec54e4a Mon Sep 17 00:00:00 2001
|
|
From: Frediano Ziglio <fziglio@redhat.com>
|
|
Date: Tue, 13 Dec 2016 14:40:10 +0000
|
|
Subject: [PATCH] Prevent integer overflows in capability checks
|
|
|
|
The limits for capabilities are specified using 32 bit unsigned integers.
|
|
This could cause possible integer overflows causing buffer overflows.
|
|
For instance the sum of num_common_caps and num_caps can be 0 avoiding
|
|
additional checks.
|
|
As the link message is now capped to 4096 and the capabilities are
|
|
contained in the link message limit the capabilities to 1024
|
|
(capabilities are expressed in number of uint32_t items).
|
|
|
|
[Peter: fixes CVE-2016-9578]
|
|
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
|
|
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
server/reds.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/server/reds.c b/server/reds.c
|
|
index 86a33d53..91504544 100644
|
|
--- a/server/reds.c
|
|
+++ b/server/reds.c
|
|
@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
|
|
link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
|
|
link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
|
|
|
|
+ /* Prevent DoS. Currently we defined only 13 capabilities,
|
|
+ * I expect 1024 to be valid for quite a lot time */
|
|
+ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
|
|
+ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
|
|
+ reds_link_free(link);
|
|
+ return;
|
|
+ }
|
|
+
|
|
num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
|
|
caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
|
|
|
|
--
|
|
2.11.0
|
|
|