Project: qemu (qemu/qemu), language: c++
Vulnerability instance: qemu.cve-2023-0330
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2160151
## Description:
Bugzilla ID: 2160151
Title: CVE-2023-0330 QEMU: lsi53c895a: DMA reentrancy issue leads to stack overflow

Description
Rohit Keshri 2023-01-11 15:25:09 UTC
A vulnerability in the lsi53c895a device which affects the latest version of qemu.

The carefully designed PoC can repeatedly trigger DMA writes but does
not limit the addresses written to the DMA, resulting in reentrancy
issues and eventually overflow. A privileged local user could use
this flaw to crash the QEMU process on the host.
It is worth noting that the DMA operation is the pci_dma_write() in
lsi_mem_write(), so the issue cannot be solved by modifying the
'attrs' flag.

The following log can reveal it:

==3850539==ERROR: AddressSanitizer: stack-overflow on address
0x7ffeb10d5e58 (pc 0x55cd154d0f16 bp 0x7ffeb10d6690 sp 0x7ffeb10d5e60
T0)
#0 0x55cd154d0f16 in __asan_memcpy
llvm/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
#1 0x55cd15b25676 in sparse_mem_read qemu/hw/mem/sparse-mem.c:50:9
#2 0x55cd16c973cd in memory_region_read_accessor
qemu/softmmu/memory.c:440:11
#3 0x55cd16c6e9fa in access_with_adjusted_size qemu/softmmu/memory.c:554:18
#4 0x55cd16c6cf11 in memory_region_dispatch_read1 qemu/softmmu/memory.c
#5 0x55cd16c6cf11 in memory_region_dispatch_read
qemu/softmmu/memory.c:1457:9
#6 0x55cd16cb9270 in flatview_read_continue qemu/softmmu/physmem.c:2892:23
#7 0x55cd16cba14f in flatview_read qemu/softmmu/physmem.c:2934:12
#8 0x55cd16cb9ee3 in address_space_read_full qemu/softmmu/physmem.c:2947:18
#9 0x55cd15ed44c5 in dma_memory_rw_relaxed qemu/include/sysemu/dma.h:87:12
#10 0x55cd15ed44c5 in dma_memory_rw qemu/include/sysemu/dma.h:130:12
#11 0x55cd15ed44c5 in pci_dma_rw qemu/include/hw/pci/pci.h:850:12
#12 0x55cd15ed44c5 in pci_dma_read qemu/include/hw/pci/pci.h:869:12
#13 0x55cd15ed44c5 in read_dword qemu/hw/scsi/lsi53c895a.c:472:5
#14 0x55cd15ed44c5 in lsi_execute_script qemu/hw/scsi/lsi53c895a.c:1154:12
#15 0x55cd15eed0e5 in lsi_command_complete qemu/hw/scsi/lsi53c895a.c:810:5
#16 0x55cd15e3d5c1 in scsi_req_complete qemu/hw/scsi/scsi-bus.c:1518:5
#17 0x55cd15e41f9c in scsi_unit_attention qemu/hw/scsi/scsi-bus.c:422:5
#18 0x55cd15e33c59 in scsi_req_enqueue qemu/hw/scsi/scsi-bus.c:890:10
#19 0x55cd15ed869c in lsi_do_command qemu/hw/scsi/lsi53c895a.c:869:9
#20 0x55cd15ed869c in lsi_execute_script qemu/hw/scsi/lsi53c895a.c:1261:13
#21 0x55cd15ece001 in lsi_reg_writeb qemu/hw/scsi/lsi53c895a.c
#22 0x55cd16c6ef86 in memory_region_write_accessor
qemu/softmmu/memory.c:492:5
#23 0x55cd16c6e9fa in access_with_adjusted_size qemu/softmmu/memory.c:554:18
#24 0x55cd16c6e2fa in memory_region_dispatch_write qemu/softmmu/memory.c
#25 0x55cd16cc274c in flatview_write_continue qemu/softmmu/physmem.c:2825:23
#26 0x55cd16cba662 in flatview_write qemu/softmmu/physmem.c:2867:12
#27 0x55cd16cba3f3 in address_space_write qemu/softmmu/physmem.c:2963:18
#28 0x55cd15ed4d5c in lsi_memcpy qemu/hw/scsi/lsi53c895a.c:1104:9
#29 0x55cd15ed4d5c in lsi_execute_script qemu/hw/scsi/lsi53c895a.c:1563:13
#30 0x55cd15ece001 in lsi_reg_writeb qemu/hw/scsi/lsi53c895a.c


Comments:
Comment 3
Mauro Matteo Cascella 2023-01-16 21:56:08 UTC
Proposed patch: https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html.

---

Comment 4
Mauro Matteo Cascella 2023-01-16 22:02:36 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 2161425]

---

Comment 5
Product Security DevOps Team 2023-01-21 10:22:31 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-0330

---

Comment 6
Mauro Matteo Cascella 2023-03-20 21:18:04 UTC
In reply to comment #3:
> Proposed patch:
> https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html.

Follow up: https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg05057.html.

---

Comment 7
Mauro Matteo Cascella 2023-03-27 18:12:30 UTC
Looks like Alexander's dma-reentracy patchset [1], planned to be merged in 8.1, should eventually fix this issue [2].

[1] https://patchew.org/QEMU/20230313082417.827484-1-alxndr@bu.edu/
[2] https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg06038.html

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool ninja-build libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev libslirp-dev patchelf wget libattr1 libattr1-dev libcap-ng-dev pkg-config
RUN git clone https://github.com/qemu/qemu qemu
RUN git -C qemu checkout 9d52aaa92bd8b301e918dc5055041932ee1e0371
WORKDIR $SRC/qemu
COPY build.sh $SRC/

Additional files:
filename: default.options
content: [libfuzzer]
close_fd_mask=3
detect_leaks=0
max_len=8192