aboutsummaryrefslogtreecommitdiff
path: root/qemu-img.texi
diff options
context:
space:
mode:
authorEric Blake <eblake@redhat.com>2017-11-22 16:25:16 -0600
committerEric Blake <eblake@redhat.com>2017-11-28 06:42:26 -0600
commitfdad35ef6c5839d50dfc14073364ac893afebc30 (patch)
tree660351a0a2b53f2084c62d45ad4755829f83707c /qemu-img.texi
parentc7e1f823aed63f49e559e7463da76d5b320be35b (diff)
nbd/server: CVE-2017-15119 Reject options larger than 32M
The NBD spec gives us permission to abruptly disconnect on clients that send outrageously large option requests, rather than having to spend the time reading to the end of the option. No real option request requires that much data anyways; and meanwhile, we already have the practice of abruptly dropping the connection on any client that sends NBD_CMD_WRITE with a payload larger than 32M. For comparison, nbdkit drops the connection on any request with more than 4096 bytes; however, that limit is probably too low (as the NBD spec states an export name can theoretically be up to 4096 bytes, which means a valid NBD_OPT_INFO could be even longer) - even if qemu doesn't permit exports longer than 256 bytes. It could be argued that a malicious client trying to get us to read nearly 4G of data on a bad request is a form of denial of service. In particular, if the server requires TLS, but a client that does not know the TLS credentials sends any option (other than NBD_OPT_STARTTLS or NBD_OPT_EXPORT_NAME) with a stated payload of nearly 4G, then the server was keeping the connection alive trying to read all the payload, tying up resources that it would rather be spending on a client that can get past the TLS handshake. Hence, this warranted a CVE. Present since at least 2.5 when handling known options, and made worse in 2.6 when fixing support for NBD_FLAG_C_FIXED_NEWSTYLE to handle unknown options. CC: qemu-stable@nongnu.org Signed-off-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'qemu-img.texi')
0 files changed, 0 insertions, 0 deletions