d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
a48a37bee2
freebsd-dev/usr.sbin/bhyve
History
John Baldwin ed9ffd2f09 Validate guest-supplied length of headers for TSO transmit requests. 
When transmitting a large TCP packet, the final transmit descriptor
includes the length of the protocol headers to be duplicated on each
segment.  The device model was trusting the guest-supplied value
without validating it.  A value of zero would result in the guest
being able to indirect a garbage pointer on the stack to overwrite
arbitrary memory in the bhyve process.  A value that was non-zero but
too small for the requested parameters resulted in the device model
reading and writing values beyond the end of the on-stack buffer used
to hold the template header.

To fix, validate the supplied length and drop requests to transmit
packets that would overflow the header buffer.  While here, initialize
the header pointer to NULL as a preventive measure so that any access
to an unallocated template header crashes they hypervisor
deterministically.

While here, only read the TCP sequence number if the packet being
split is a TCP packet.  The e1000 logic supports a segmentation of UDP
frames, and while UDP segmentation requires this part of the header to
be valid (so there is no buffer overflow), only reading the field when
needed is cleaner.

admbugs:	918
Reported by:	Reno Robert <renorobert@gmail.com>
Reviewed by:	markj
Approved by:	so
Security:	CVE-2019-5609
2019-08-05 21:39:55 +00:00
..
acpi.c Acpi MADT table correction for VM_MAXCPU > 21 2019-04-25 22:52:44 +00:00
acpi.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
ahci.h Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
atkbdc.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
atkbdc.h
audio.c bhyve/audio: don't leak resources on failed initialization. 2019-07-03 17:24:24 +00:00
audio.h Add SPDX tags to bhyve(8) HD Audio device. 2019-06-25 06:24:56 +00:00
bhyve.8 Correct name of vmm(4) pptdevs variable. 2019-07-02 14:53:51 +00:00
bhyvegc.c When this code was introduced at r300829 the author forgot to add 2018-06-13 04:00:21 +00:00
bhyvegc.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
bhyverun.c Revert r343634: 2019-02-01 03:09:11 +00:00
bhyverun.h Make bhyve SMBIOS table topology aware 2019-04-25 22:53:55 +00:00
block_if.c Increase the VirtIO segment count to support modern Windows guests. 2019-05-02 22:46:37 +00:00
block_if.h Increase the VirtIO segment count to support modern Windows guests. 2019-05-02 22:46:37 +00:00
bootrom.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
bootrom.h Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
console.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
console.h Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
consport.c Use capsicum_helpers(3) that allow us to simplify the code and its functions 2019-01-16 00:39:23 +00:00
dbgport.c Use capsicum_helpers(3) that allow us to simplify the code and its functions 2019-01-16 00:39:23 +00:00
dbgport.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
fwctl.c Always treat firmware request and response sizes as unsigned. 2018-12-04 18:28:25 +00:00
fwctl.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
gdb.c Use parse_integer to avoid sign extension. 2019-06-05 23:37:50 +00:00
gdb.h Drop "All rights reserved" from my copyright statements. 2019-03-06 22:11:45 +00:00
hda_codec.c Add SPDX tags to bhyve(8) HD Audio device. 2019-06-25 06:24:56 +00:00
hda_reg.h Add SPDX tags to bhyve(8) HD Audio device. 2019-06-25 06:24:56 +00:00
hdac_reg.h Add SPDX tags to bhyve(8) HD Audio device. 2019-06-25 06:24:56 +00:00
inout.c Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
inout.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
ioapic.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
ioapic.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
iov.c Fix several iov handling bugs in bhyve virtio-scsi backend. 2018-12-07 20:30:00 +00:00
iov.h Fix several iov handling bugs in bhyve virtio-scsi backend. 2018-12-07 20:30:00 +00:00
Makefile bhyve: abstraction for network backends 2019-07-07 12:15:24 +00:00
Makefile.depend
mem.c Add support for writing to guest memory in the debug server. 2019-05-24 00:34:13 +00:00
mem.h Add support for writing to guest memory in the debug server. 2019-05-24 00:34:13 +00:00
mevent_test.c Improve bhyve exit(3) error code. 2018-07-11 03:23:09 +00:00
mevent.c usr.sbin/bhyve: send an initialized value to wake up blocking kqueue 2019-07-11 23:54:50 +00:00
mevent.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
mptbl.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
mptbl.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
net_backends.c usr.sbin/bhyve: close backend file descriptor during tap init error 2019-07-12 18:50:46 +00:00
net_backends.h bhyve: add missing license identifiers in net_utils and net_backend 2019-07-09 22:04:33 +00:00
net_utils.c bhyve: add missing license identifiers in net_utils and net_backend 2019-07-09 22:04:33 +00:00
net_utils.h bhyve: add missing license identifiers in net_utils and net_backend 2019-07-09 22:04:33 +00:00
pci_ahci.c Define AHCI_PORT_IDENT and increase by 1 the VTBLK_BLK_ID_BYTES 2018-11-20 22:21:19 +00:00
pci_e82545.c Validate guest-supplied length of headers for TSO transmit requests. 2019-08-05 21:39:55 +00:00
pci_emul.c Remove a spurious break when setting up a 64-bit memory BAR. 2019-06-12 16:49:01 +00:00
pci_emul.h Keep the shadow PCIR_COMMAND synced with the real one for pass through. 2019-06-07 15:53:27 +00:00
pci_fbuf.c usr.sbin/bhyve: commit miss from r349918 2019-07-11 19:51:33 +00:00
pci_hda.c Fix the register layout for the Buffer Descript List Entry. It 2019-07-23 18:40:07 +00:00
pci_hda.h Add SPDX tags to bhyve(8) HD Audio device. 2019-06-25 06:24:56 +00:00
pci_hostbridge.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
pci_irq.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
pci_irq.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
pci_lpc.c Add -s "help" and -l "help" to print a list of supported PCI and LPC devices. 2018-08-22 20:23:08 +00:00
pci_lpc.h Add -s "help" and -l "help" to print a list of supported PCI and LPC devices. 2018-08-22 20:23:08 +00:00
pci_nvme.c bhyve: update the NVMe CQ based on the status 2019-07-17 03:19:30 +00:00
pci_passthru.c usr.sbin/bhyve: only unassign a pt device after obtaining bus/slot/func 2019-07-12 18:33:58 +00:00
pci_uart.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
pci_virtio_block.c Increase the VirtIO segment count to support modern Windows guests. 2019-05-02 22:46:37 +00:00
pci_virtio_console.c usr.sbin/bhyve: free resources when erroring out of pci_vtcon_sock_add() 2019-07-12 18:20:56 +00:00
pci_virtio_net.c usr.sbin/bhyve: free resources when erroring out of pci_vtnet_init() 2019-07-12 05:19:37 +00:00
pci_virtio_rnd.c Use capsicum_helpers(3) that allow us to simplify the code and its functions 2019-01-16 00:39:23 +00:00
pci_virtio_scsi.c usr.sbin/bhyve: prevent use-after-free in virtio scsi request handling 2019-07-12 18:17:35 +00:00
pci_xhci.c bhyve: correct out-of-bounds read in XHCI device emulation 2019-07-23 16:27:36 +00:00
pci_xhci.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
pm.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
post.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
ps2kbd.c Remove printf for debug purpose forgotten on r340046. 2018-11-02 13:48:06 +00:00
ps2kbd.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
ps2mouse.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
ps2mouse.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
rfb.c usr.sbin/bhyve: free resources if there is an initialization error in rfb 2019-07-11 19:07:45 +00:00
rfb.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
rtc.c Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
rtc.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
smbiostbl.c Make bhyve SMBIOS table topology aware 2019-04-25 22:53:55 +00:00
smbiostbl.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
sockstream.c Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
sockstream.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
spinup_ap.c various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
spinup_ap.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
task_switch.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
uart_emul.c usr.sbin/bhyve: don't leak a FD if the device is not a tty 2019-07-12 18:13:58 +00:00
uart_emul.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00
usb_emul.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
usb_emul.h Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
usb_mouse.c Revert r343634: 2019-02-01 03:09:11 +00:00
vga.c Add SPDX tags to bhyve(8). 2018-06-13 03:22:08 +00:00
vga.h Fix style(9) space vs tab. 2018-06-14 01:34:53 +00:00
virtio.c bhyve: virtio: introduce vq_kick_enable() and vq_kick_disable() 2019-06-11 15:52:41 +00:00
virtio.h bhyve: virtio: introduce vq_kick_enable() and vq_kick_disable() 2019-06-11 15:52:41 +00:00
xmsr.c Emulate the AMD MSR_LS_CFG MSR used for various Ryzen errata. 2019-06-03 23:17:35 +00:00
xmsr.h various: general adoption of SPDX licensing ID tags. 2017-11-27 15:37:16 +00:00