From patchwork Wed Sep 17 11:41:30 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Petr Matousek X-Patchwork-Id: 390362 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 129421400E2 for ; Wed, 17 Sep 2014 21:42:06 +1000 (EST) Received: from localhost ([::1]:44281 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XUDcZ-0000n8-Qn for incoming@patchwork.ozlabs.org; Wed, 17 Sep 2014 07:42:03 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36293) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XUDcG-0000Vz-3h for qemu-devel@nongnu.org; Wed, 17 Sep 2014 07:41:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XUDcA-0003Wd-R4 for qemu-devel@nongnu.org; Wed, 17 Sep 2014 07:41:44 -0400 Received: from mx1.redhat.com ([209.132.183.28]:28230) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XUDcA-0003Vk-Kz for qemu-devel@nongnu.org; Wed, 17 Sep 2014 07:41:38 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s8HBfYaY008787 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Wed, 17 Sep 2014 07:41:34 -0400 Received: from dhcp-25-225.brq.redhat.com (dhcp-27-207.brq.redhat.com [10.34.27.207]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s8HBfVvB010939 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO); Wed, 17 Sep 2014 07:41:33 -0400 Date: Wed, 17 Sep 2014 13:41:30 +0200 From: Petr Matousek To: qemu-devel@nongnu.org Message-ID: <20140917114130.GT9321@dhcp-25-225.brq.redhat.com> MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Jan Kiszka Subject: [Qemu-devel] [PATCH] slirp: udp: fix NULL pointer dereference because of uninitialized socket X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and later passed to sosendto() where NULL pointer dereference is hit during so->slirp->vnetwork_mask.s_addr access. Fix this by checking that the socket is in initialized state. This is CVE-2014-3640. Signed-off-by: Petr Matousek Reported-by: Xavier Mehrenberger Reported-by: Stephane Duverger Reviewed-by: Michael S. Tsirkin --- slirp/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/slirp/udp.c b/slirp/udp.c index 8cc6cb6..4affcc6 100644 --- a/slirp/udp.c +++ b/slirp/udp.c @@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) * Locate pcb for datagram. */ so = slirp->udp_last_so; - if (so->so_lport != uh->uh_sport || + if (!so->so_state || so->so_lport != uh->uh_sport || so->so_laddr.s_addr != ip->ip_src.s_addr) { struct socket *tmp;