diff mbox series

[scarthgap] qemu: patch CVE-2024-6505

Message ID 20241202233844.2808663-1-peter.marko@siemens.com
State Rejected
Delegated to: Steve Sakoman
Headers show
Series [scarthgap] qemu: patch CVE-2024-6505 | expand

Commit Message

Marko, Peter Dec. 2, 2024, 11:38 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Backport patch [3] as linked from [1] via [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505
[2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760
[3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-devtools/qemu/qemu.inc           |  1 +
 .../qemu/qemu/CVE-2024-6505.patch             | 40 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch

Comments

Steve Sakoman Dec. 3, 2024, 1:52 p.m. UTC | #1 
This is fixed in the qemu minor version upgrade currently out for review:

https://lists.openembedded.org/g/openembedded-core/message/208200

Steve

On Mon, Dec 2, 2024 at 3:39 PM Peter Marko via lists.openembedded.org
<peter.marko=siemens.com@lists.openembedded.org> wrote:
>
> From: Peter Marko <peter.marko@siemens.com>
>
> Backport patch [3] as linked from [1] via [2].
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760
> [3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta/recipes-devtools/qemu/qemu.inc           |  1 +
>  .../qemu/qemu/CVE-2024-6505.patch             | 40 +++++++++++++++++++
>  2 files changed, 41 insertions(+)
>  create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
>
> diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
> index e9f63b9eaf..f07869cc4d 100644
> --- a/meta/recipes-devtools/qemu/qemu.inc
> +++ b/meta/recipes-devtools/qemu/qemu.inc
> @@ -52,6 +52,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
>             file://0001-target-riscv-kvm-change-KVM_REG_RISCV_FP_F-to-u32.patch \
>             file://0002-target-riscv-kvm-change-KVM_REG_RISCV_FP_D-to-u64.patch \
>             file://0003-target-riscv-kvm-change-timer-regs-size-to-u64.patch \
> +           file://CVE-2024-6505.patch \
>             "
>  UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
>
> diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch b/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
> new file mode 100644
> index 0000000000..fbb7ad31b2
> --- /dev/null
> +++ b/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
> @@ -0,0 +1,40 @@
> +From f1595ceb9aad36a6c1da95bcb77ab9509b38822d Mon Sep 17 00:00:00 2001
> +From: Akihiko Odaki <akihiko.odaki@daynix.com>
> +Date: Mon, 1 Jul 2024 20:58:04 +0900
> +Subject: [PATCH] virtio-net: Ensure queue index fits with RSS
> +
> +Ensure the queue index points to a valid queue when software RSS
> +enabled. The new calculation matches with the behavior of Linux's TAP
> +device with the RSS eBPF program.
> +
> +Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
> +Reported-by: Zhibin Hu <huzhibin5@huawei.com>
> +Cc: qemu-stable@nongnu.org
> +Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
> +Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
> +Signed-off-by: Jason Wang <jasowang@redhat.com>
> +
> +CVE: CVE-2024-6505
> +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb9aad36a6c1da95bcb77ab9509b38822d]
> +Signed-off-by: Peter Marko <peter.marko@siemens.com>
> +---
> + hw/net/virtio-net.c | 3 ++-
> + 1 file changed, 2 insertions(+), 1 deletion(-)
> +
> +diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> +index 8f30972708..5635620a31 100644
> +--- a/hw/net/virtio-net.c
> ++++ b/hw/net/virtio-net.c
> +@@ -1909,7 +1909,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
> +     if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
> +         int index = virtio_net_process_rss(nc, buf, size);
> +         if (index >= 0) {
> +-            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
> ++            NetClientState *nc2 =
> ++                qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
> +             return virtio_net_receive_rcu(nc2, buf, size, true);
> +         }
> +     }
> +--
> +2.30.2
> +
> --
> 2.30.2
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#208164): https://lists.openembedded.org/g/openembedded-core/message/208164
> Mute This Topic: https://lists.openembedded.org/mt/109891410/3620601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Marko, Peter Dec. 3, 2024, 1:56 p.m. UTC | #2 
Good to know.
Then I'll just have to submit CVE ignore patch when that merges as this vulnerability is version-less in NVD DB...

Peter

> -----Original Message-----
> From: Steve Sakoman <steve@sakoman.com>
> Sent: Tuesday, December 3, 2024 14:53
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> Cc: openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core][scarthgap][PATCH] qemu: patch CVE-2024-6505
> 
> This is fixed in the qemu minor version upgrade currently out for review:
> 
> https://lists.openembedded.org/g/openembedded-core/message/208200
> 
> Steve
> 
> On Mon, Dec 2, 2024 at 3:39 PM Peter Marko via lists.openembedded.org
> <peter.marko=siemens.com@lists.openembedded.org> wrote:
> >
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > Backport patch [3] as linked from [1] via [2].
> >
> > [1] https://nvd.nist.gov/vuln/detail/CVE-2024-6505
> > [2] https://bugzilla.redhat.com/show_bug.cgi?id=2295760
> > [3] https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> >  meta/recipes-devtools/qemu/qemu.inc           |  1 +
> >  .../qemu/qemu/CVE-2024-6505.patch             | 40 +++++++++++++++++++
> >  2 files changed, 41 insertions(+)
> >  create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-
> 6505.patch
> >
> > diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-
> devtools/qemu/qemu.inc
> > index e9f63b9eaf..f07869cc4d 100644
> > --- a/meta/recipes-devtools/qemu/qemu.inc
> > +++ b/meta/recipes-devtools/qemu/qemu.inc
> > @@ -52,6 +52,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-
> ${PV}.tar.xz \
> >             file://0001-target-riscv-kvm-change-KVM_REG_RISCV_FP_F-to-
> u32.patch \
> >             file://0002-target-riscv-kvm-change-KVM_REG_RISCV_FP_D-to-
> u64.patch \
> >             file://0003-target-riscv-kvm-change-timer-regs-size-to-u64.patch \
> > +           file://CVE-2024-6505.patch \
> >             "
> >  UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
> >
> > diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
> b/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
> > new file mode 100644
> > index 0000000000..fbb7ad31b2
> > --- /dev/null
> > +++ b/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
> > @@ -0,0 +1,40 @@
> > +From f1595ceb9aad36a6c1da95bcb77ab9509b38822d Mon Sep 17
> 00:00:00 2001
> > +From: Akihiko Odaki <akihiko.odaki@daynix.com>
> > +Date: Mon, 1 Jul 2024 20:58:04 +0900
> > +Subject: [PATCH] virtio-net: Ensure queue index fits with RSS
> > +
> > +Ensure the queue index points to a valid queue when software RSS
> > +enabled. The new calculation matches with the behavior of Linux's TAP
> > +device with the RSS eBPF program.
> > +
> > +Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
> > +Reported-by: Zhibin Hu <huzhibin5@huawei.com>
> > +Cc: qemu-stable@nongnu.org
> > +Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
> > +Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
> > +Signed-off-by: Jason Wang <jasowang@redhat.com>
> > +
> > +CVE: CVE-2024-6505
> > +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-
> /commit/f1595ceb9aad36a6c1da95bcb77ab9509b38822d]
> > +Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > +---
> > + hw/net/virtio-net.c | 3 ++-
> > + 1 file changed, 2 insertions(+), 1 deletion(-)
> > +
> > +diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> > +index 8f30972708..5635620a31 100644
> > +--- a/hw/net/virtio-net.c
> > ++++ b/hw/net/virtio-net.c
> > +@@ -1909,7 +1909,8 @@ static ssize_t
> virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
> > +     if (!no_rss && n->rss_data.enabled && n-
> >rss_data.enabled_software_rss) {
> > +         int index = virtio_net_process_rss(nc, buf, size);
> > +         if (index >= 0) {
> > +-            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
> > ++            NetClientState *nc2 =
> > ++                qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
> > +             return virtio_net_receive_rcu(nc2, buf, size, true);
> > +         }
> > +     }
> > +--
> > +2.30.2
> > +
> > --
> > 2.30.2
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#208164):
> https://lists.openembedded.org/g/openembedded-core/message/208164
> > Mute This Topic: https://lists.openembedded.org/mt/109891410/3620601
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe: https://lists.openembedded.org/g/openembedded-
> core/unsub [steve@sakoman.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
diff mbox series

Patch

diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index e9f63b9eaf..f07869cc4d 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -52,6 +52,7 @@  SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
            file://0001-target-riscv-kvm-change-KVM_REG_RISCV_FP_F-to-u32.patch \
            file://0002-target-riscv-kvm-change-KVM_REG_RISCV_FP_D-to-u64.patch \
            file://0003-target-riscv-kvm-change-timer-regs-size-to-u64.patch \
+           file://CVE-2024-6505.patch \
            "
 UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
 
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch b/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
new file mode 100644
index 0000000000..fbb7ad31b2
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2024-6505.patch
@@ -0,0 +1,40 @@ 
+From f1595ceb9aad36a6c1da95bcb77ab9509b38822d Mon Sep 17 00:00:00 2001
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
+Date: Mon, 1 Jul 2024 20:58:04 +0900
+Subject: [PATCH] virtio-net: Ensure queue index fits with RSS
+
+Ensure the queue index points to a valid queue when software RSS
+enabled. The new calculation matches with the behavior of Linux's TAP
+device with the RSS eBPF program.
+
+Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
+Reported-by: Zhibin Hu <huzhibin5@huawei.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+
+CVE: CVE-2024-6505
+Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/f1595ceb9aad36a6c1da95bcb77ab9509b38822d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ hw/net/virtio-net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index 8f30972708..5635620a31 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1909,7 +1909,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
+         int index = virtio_net_process_rss(nc, buf, size);
+         if (index >= 0) {
+-            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
++            NetClientState *nc2 =
++                qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
+             return virtio_net_receive_rcu(nc2, buf, size, true);
+         }
+     }
+-- 
+2.30.2
+