Bug 1955695 (CVE-2021-3527) - CVE-2021-3527 QEMU: usb: unbounded stack allocation in usbredir
Summary: CVE-2021-3527 QEMU: usb: unbounded stack allocation in usbredir
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2021-3527
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1956201 1956221 1956222 1956223 1956224 1956225
Blocks: 1949585 1955699
TreeView+ depends on / blocked
 
Reported: 2021-04-30 16:52 UTC by Mauro Matteo Cascella
Modified: 2022-05-17 08:45 UTC (History)
27 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-10-29 08:59:58 UTC
Embargoed:


Attachments (Terms of Use)

Description Mauro Matteo Cascella 2021-04-30 16:52:07 UTC
A flaw was found in the USB redirection support (usb-redir) of QEMU. More specifically, usb-host and usb-redirect try to batch bulk transfers by combining many small USB packets into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk sending is used in usbredir_handle_bulk_data() to dynamically allocate a variable length array (VLA) on the stack. Since the total size is not bounded, a malicious guest could be able to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.

Comment 2 Mauro Matteo Cascella 2021-05-03 07:58:03 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1956201]

Comment 4 Mauro Matteo Cascella 2021-05-03 08:45:33 UTC
Statement:

This issue affects the version of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

Comment 5 Mauro Matteo Cascella 2021-05-03 08:55:49 UTC
Upstream patch series:
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg00564.html

Comment 7 Mauro Matteo Cascella 2021-05-05 19:04:13 UTC
External References:

https://www.openwall.com/lists/oss-security/2021/05/05/5

Comment 8 Mauro Matteo Cascella 2021-05-07 08:51:48 UTC
Acknowledgments:

Name: Remy Noel (Blade Group)

Comment 9 Mauro Matteo Cascella 2021-05-07 09:42:58 UTC
In reply to comment #5:
> Upstream patch series:
> https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg00564.html

Note that the xhci patch was dropped [1] and a new USB patchset has been proposed without it [2]. As discussed upstream, this could leave room for unbound allocation on the heap, although more difficult to exploit by the guest to crash the QEMU process on the host.

[1] https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01372.html
[2] https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01373.html


Note You need to log in before you can comment on or make changes to this bug.