CVE-2013-2016: Improper Privilege Management (CWE-269)
value: A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2019-12-30T22:15Z
Repository: https://github.com/qemu/qemu
Language: C
Files changed: hw/virtio/virtio.c
Commit date: 2013-05-08 15:54:21 -0500
Commit message: virtio: properly validate address before accessing config

There are several several issues in the current checking:

- The check was based on the minus of unsigned values which can overflow
- It was done after .{set|get}_config() which can lead crash when config_len
  is zero since vdev->config is NULL

Fix this by:

- Validate the address in virtio_pci_config_{read|write}() before
  .{set|get}_config
- Use addition instead minus to do the validation

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Petr Matousek <pmatouse@redhat.com>
Message-id: 1367905369-10765-1-git-send-email-jasowang@redhat.com
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Diff: diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 53a0d9046..8176c147e 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -566,54 +566,58 @@ void virtio_reset(void *opaque)
 uint32_t virtio_config_readb(VirtIODevice *vdev, uint32_t addr)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint8_t val;
 
-    k->get_config(vdev, vdev->config);
-
-    if (addr > (vdev->config_len - sizeof(val)))
+    if (addr + sizeof(val) > vdev->config_len) {
         return (uint32_t)-1;
+    }
+
+    k->get_config(vdev, vdev->config);
 
     val = ldub_p(vdev->config + addr);
     return val;
 }
 
 uint32_t virtio_config_readw(VirtIODevice *vdev, uint32_t addr)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint16_t val;
 
-    k->get_config(vdev, vdev->config);
-
-    if (addr > (vdev->config_len - sizeof(val)))
+    if (addr + sizeof(val) > vdev->config_len) {
         return (uint32_t)-1;
+    }
+
+    k->get_config(vdev, vdev->config);
 
     val = lduw_p(vdev->config + addr);
     return val;
 }
 
 uint32_t virtio_config_readl(VirtIODevice *vdev, uint32_t addr)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint32_t val;
 
-    k->get_config(vdev, vdev->config);
-
-    if (addr > (vdev->config_len - sizeof(val)))
+    if (addr + sizeof(val) > vdev->config_len) {
         return (uint32_t)-1;
+    }
+
+    k->get_config(vdev, vdev->config);
 
     val = ldl_p(vdev->config + addr);
     return val;
 }
 
 void virtio_config_writeb(VirtIODevice *vdev, uint32_t addr, uint32_t data)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint8_t val = data;
 
-    if (addr > (vdev->config_len - sizeof(val)))
+    if (addr + sizeof(val) > vdev->config_len) {
         return;
+    }
 
     stb_p(vdev->config + addr, val);
 
     if (k->set_config) {
         k->set_config(vdev, vdev->config);
@@ -623,12 +627,13 @@ void virtio_config_writeb(VirtIODevice *vdev, uint32_t addr, uint32_t data)
 void virtio_config_writew(VirtIODevice *vdev, uint32_t addr, uint32_t data)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint16_t val = data;
 
-    if (addr > (vdev->config_len - sizeof(val)))
+    if (addr + sizeof(val) > vdev->config_len) {
         return;
+    }
 
     stw_p(vdev->config + addr, val);
 
     if (k->set_config) {
         k->set_config(vdev, vdev->config);
@@ -638,12 +643,13 @@ void virtio_config_writew(VirtIODevice *vdev, uint32_t addr, uint32_t data)
 void virtio_config_writel(VirtIODevice *vdev, uint32_t addr, uint32_t data)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint32_t val = data;
 
-    if (addr > (vdev->config_len - sizeof(val)))
+    if (addr + sizeof(val) > vdev->config_len) {
         return;
+    }
 
     stl_p(vdev->config + addr, val);
 
     if (k->set_config) {
         k->set_config(vdev, vdev->config);

Vulnerable code:     k->get_config(vdev, vdev->config);

    if (addr > (vdev->config_len - sizeof(val)))
    k->get_config(vdev, vdev->config);

    if (addr > (vdev->config_len - sizeof(val)))
    k->get_config(vdev, vdev->config);

    if (addr > (vdev->config_len - sizeof(val)))
    if (addr > (vdev->config_len - sizeof(val)))
    if (addr > (vdev->config_len - sizeof(val)))
    if (addr > (vdev->config_len - sizeof(val)))
Fixed code:     if (addr + sizeof(val) > vdev->config_len) {
    }

    k->get_config(vdev, vdev->config);
    if (addr + sizeof(val) > vdev->config_len) {
    }

    k->get_config(vdev, vdev->config);
    if (addr + sizeof(val) > vdev->config_len) {
    }

    k->get_config(vdev, vdev->config);
    if (addr + sizeof(val) > vdev->config_len) {
    }
    if (addr + sizeof(val) > vdev->config_len) {
    }
    if (addr + sizeof(val) > vdev->config_len) {
    }