Red Hat Bugzilla – Bug 1297748
[RFE] Allocate guard pages after guest RAM to protect against buffer overflows
Last modified: 2016-11-07 15:54:17 EST
Description of problem: * Latest Qemu version 2.5 has enabled insertion of Guard Pages after the Guest RAM. This is to protect against any guest triggered buffer overflow issues. * http://wiki.qemu.org/ChangeLog/2.5#System_emulation * git.qemu.org/?p=qemu.git;a=commit;h=f293709c6af7a65a9bcec09cdba7a60183657a3e It'd be real good to back-port this feature to current RHEL qemu-kvm packages.
Patch set -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg06894.html
QE has verified this bug by checking mmap from output of strace. Steps: 1. boot guest with strace #strace -e mmap -o mmap.log /usr/libexec/qemu-kvm -m 4G,slots=256,maxmem=40G\ -numa node -drive file=win2012r2.qcow2,if=none,cache=none,format=qcow2,id=drive0 -device ide-drive,drive=drive0,id=ide-drive \ -usb -device usb-tablet,id=input0 -netdev tap,id=hostnet1 -device virtio-net-pci,mac=42:ce:a9:d2:4d:d9,id=idlbq7eA,netdev=hostnet1 -vga qxl \ -spice port=5901,addr=0.0.0.0,disable-ticketing,image-compression=off,seamless-migration=on -monitor stdio 2. check the output of strace # grep PROT_NONE mmap.log With qemu-kvm-rhev-2.3.0-31.el7, there is no output in step 2. With qemu-kvm-rhev-2.6.0-26.el7, below is the output: mmap(NULL, 4297064448, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd038843000 mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0387c0000 mmap(NULL, 2228224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0385e0000 mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd034400000 mmap(NULL, 2105344, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0341fe000 mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd030000000 mmap(NULL, 2162688, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f5ef000 mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f3c0000 mmap(NULL, 4194304, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f000000 mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02edff000 mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02ebff000
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2673.html