]> git.ipfire.org Git - thirdparty/qemu.git/commit
hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
authorThomas Huth <thuth@redhat.com>
Mon, 25 Sep 2023 09:18:54 +0000 (11:18 +0200)
committerMichael Tokarev <mjt@tls.msk.ru>
Mon, 2 Oct 2023 23:00:54 +0000 (02:00 +0300)
commit6b7fa3cbab92097785a7c1c67b3ccb1047ca4919
tree960653fafbaf42cd33fa63b4da21fcf56e72d2a9
parentb9b84b2d4190eef78fffdb1f1063e3e37ebbc91a
hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]

We are doing things like

    nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);

in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7cfcc79b0ab800959716738aff9419f53fc68c9c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
hw/scsi/scsi-disk.c