Bug 1297748

Summary:	[RFE] Allocate guard pages after guest RAM to protect against buffer overflows
Product:	Red Hat Enterprise Linux 7	Reporter:	Prasad Pandit <ppandit>
Component:	qemu-kvm-rhev	Assignee:	Victor Kaplansky <victork>
Status:	CLOSED ERRATA	QA Contact:	Yumei Huang <yuhuang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.3	CC:	ailan, chayang, huding, jen, juzhang, knoel, mrezanin, mst, rbalakri, victork, virt-maint, xfu, yuhuang
Target Milestone:	rc	Keywords:	FutureFeature, Reopened, Security
Target Release:	---
Hardware:	All
OS:	All
Whiteboard:
Fixed In Version:	Qemu-2.5	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-07 20:54:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Prasad Pandit 2016-01-12 11:28:39 UTC

Description of problem:

 * Latest Qemu version 2.5 has enabled insertion of Guard Pages after the Guest RAM. This is to protect against any guest triggered buffer overflow issues.

 * http://wiki.qemu.org/ChangeLog/2.5#System_emulation
 * git.qemu.org/?p=qemu.git;a=commit;h=f293709c6af7a65a9bcec09cdba7a60183657a3e


It'd be real good to back-port this feature to current RHEL qemu-kvm packages.

Comment 2 Prasad Pandit 2016-06-17 04:38:20 UTC

Patch set
  -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg06894.html

Comment 10 Yumei Huang 2016-09-22 09:10:38 UTC

QE has verified this bug by checking mmap from output of strace. 

Steps:
1. boot guest with strace
#strace -e mmap -o mmap.log  /usr/libexec/qemu-kvm -m 4G,slots=256,maxmem=40G\ 

-numa node -drive file=win2012r2.qcow2,if=none,cache=none,format=qcow2,id=drive0 -device ide-drive,drive=drive0,id=ide-drive  \

-usb -device usb-tablet,id=input0 -netdev tap,id=hostnet1 -device virtio-net-pci,mac=42:ce:a9:d2:4d:d9,id=idlbq7eA,netdev=hostnet1 -vga qxl \

-spice port=5901,addr=0.0.0.0,disable-ticketing,image-compression=off,seamless-migration=on -monitor stdio

2. check the output of strace
# grep PROT_NONE mmap.log


With qemu-kvm-rhev-2.3.0-31.el7, there is no output in step 2.

With qemu-kvm-rhev-2.6.0-26.el7, below is the output:

mmap(NULL, 4297064448, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd038843000
mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0387c0000
mmap(NULL, 2228224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0385e0000
mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd034400000
mmap(NULL, 2105344, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0341fe000
mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd030000000
mmap(NULL, 2162688, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f5ef000
mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f3c0000
mmap(NULL, 4194304, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f000000
mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02edff000
mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02ebff000

Comment 13 errata-xmlrpc 2016-11-07 20:54:17 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2673.html