Bug 1297748 - [RFE] Allocate guard pages after guest RAM to protect against buffer overflows [NEEDINFO]
[RFE] Allocate guard pages after guest RAM to protect against buffer overflows
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm-rhev (Show other bugs)
7.3
All All
medium Severity medium
: rc
: ---
Assigned To: Victor Kaplansky
Yumei Huang
: FutureFeature, Reopened, Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-12 06:28 EST by Prasad J Pandit
Modified: 2016-11-07 15:54 EST (History)
13 users (show)

See Also:
Fixed In Version: Qemu-2.5
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-07 15:54:17 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
yuhuang: needinfo? (victork)


Attachments (Terms of Use)

  None (edit)
Description Prasad J Pandit 2016-01-12 06:28:39 EST
Description of problem:

 * Latest Qemu version 2.5 has enabled insertion of Guard Pages after the Guest RAM. This is to protect against any guest triggered buffer overflow issues.

 * http://wiki.qemu.org/ChangeLog/2.5#System_emulation
 * git.qemu.org/?p=qemu.git;a=commit;h=f293709c6af7a65a9bcec09cdba7a60183657a3e


It'd be real good to back-port this feature to current RHEL qemu-kvm packages.
Comment 2 Prasad J Pandit 2016-06-17 00:38:20 EDT
Patch set
  -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg06894.html
Comment 10 Yumei Huang 2016-09-22 05:10:38 EDT
QE has verified this bug by checking mmap from output of strace. 

Steps:
1. boot guest with strace
#strace -e mmap -o mmap.log  /usr/libexec/qemu-kvm -m 4G,slots=256,maxmem=40G\ 

-numa node -drive file=win2012r2.qcow2,if=none,cache=none,format=qcow2,id=drive0 -device ide-drive,drive=drive0,id=ide-drive  \

-usb -device usb-tablet,id=input0 -netdev tap,id=hostnet1 -device virtio-net-pci,mac=42:ce:a9:d2:4d:d9,id=idlbq7eA,netdev=hostnet1 -vga qxl \

-spice port=5901,addr=0.0.0.0,disable-ticketing,image-compression=off,seamless-migration=on -monitor stdio

2. check the output of strace
# grep PROT_NONE mmap.log


With qemu-kvm-rhev-2.3.0-31.el7, there is no output in step 2.

With qemu-kvm-rhev-2.6.0-26.el7, below is the output:

mmap(NULL, 4297064448, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd038843000
mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0387c0000
mmap(NULL, 2228224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0385e0000
mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd034400000
mmap(NULL, 2105344, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd0341fe000
mmap(NULL, 69206016, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd030000000
mmap(NULL, 2162688, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f5ef000
mmap(NULL, 2359296, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f3c0000
mmap(NULL, 4194304, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02f000000
mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02edff000
mmap(NULL, 2101248, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd02ebff000
Comment 13 errata-xmlrpc 2016-11-07 15:54:17 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2673.html

Note You need to log in before you can comment on or make changes to this bug.