XSA-140

CVE-2015-5165

问题描述

http://xenbits.xen.org/xsa/advisory-140.html

QEMU leak of uninitialized heap memory in rtl8139 device model

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

The QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation. This results in uninitialised memory from the QEMU process’s heap being leaked to the domain as well as to the network.

improper input validation (uninitialized memory)

Patch描述

http://xenbits.xen.org/xsa/xsa139-qemuu-4.5.patch

The TCP Data Offset field contains the length of the header. Make sure it is valid and does not exceed the IP data length.

--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -2253,6 +2253,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
                 int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
 
+                /* Invalid TCP data offset? */
+                if (tcp_hlen < sizeof(tcp_header) || tcp_hlen > ip_data_len) {
+                    goto skip_offload;
+                }
+
                 /* ETH_MTU = ip header len + tcp header len + payload */
                 int tcp_data_len = ip_data_len - tcp_hlen;
                 int tcp_chunk_size = ETH_MTU - hlen - tcp_hlen;

Consequence

A guest may be able to read sensitive host-level data relating to itself which resides in the QEMU process.

Such information may include things such as information relating to real devices backing emulated devices or passwords which the host administrator does not intend to share with the guest admin.

information leak