diff options
| author | Thomas Huth <thuth@redhat.com> | 2023-09-25 11:18:54 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-09-28 07:32:23 +0300 |
| commit | 66aa4b1b4b14b93cc726082755828ed9265509b2 (patch) | |
| tree | 467741a3262bc962f1ad7c2974f208b9431e03f0 /ui/x_keymap.c | |
| parent | e6fdfb8433743bc882d11728b6b9e3d03f8ccdd2 (diff) | |
hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]
We are doing things like
nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7cfcc79b0ab800959716738aff9419f53fc68c9c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'ui/x_keymap.c')
0 files changed, 0 insertions, 0 deletions