diff options
| author | Pierre Pronchery <pierre@freebsdfoundation.org> | 2024-09-04 14:38:12 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2024-09-04 20:54:02 +0000 |
| commit | 9a77f052cab78165b39e6c6c392381991167e21c (patch) | |
| tree | 273bba3340d75918916b1129c65fda022014f20a | |
| parent | f7aa7c38318c700cc6915b4a48941a6b9a0807c0 (diff) | |
ctl: fix Out-Of-Bounds access in ctl_report_supported_opcodes
This vulnerability is directly accessible to a guest VM through the
pci_virtio_scsi bhyve device.
In the function ctl_report_supported_opcodes() accessible from the VM,
the option RSO_OPTIONS_OC_ASA does not check the requested
service_action value before accessing &ctl_cmd_table[].
Reported by: Synacktiv
Reviewed by: asomers
Security: FreeBSD-SA-24:11.ctl
Security: CVE-2024-42416
Security: HYP-06
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46027
(cherry picked from commit af438acbfde3d25dbdc82b2b3d72380f0191e9d9)
(cherry picked from commit 803e0c2ab29bb6b715c38e82da4930d46590e8e0)
Approved by: so
| -rw-r--r-- | sys/cam/ctl/ctl.c | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c index f48fc203b90d..5f5987e515c0 100644 --- a/sys/cam/ctl/ctl.c +++ b/sys/cam/ctl/ctl.c @@ -7514,20 +7514,19 @@ ctl_report_supported_opcodes(struct ctl_scsiio *ctsio) case RSO_OPTIONS_OC_SA: if ((ctl_cmd_table[opcode].flags & CTL_CMD_FLAG_SA5) == 0 || service_action >= 32) { - ctl_set_invalid_field(/*ctsio*/ ctsio, - /*sks_valid*/ 1, - /*command*/ 1, - /*field*/ 2, - /*bit_valid*/ 1, - /*bit*/ 2); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto invalid; } - /* FALLTHROUGH */ + total_len = sizeof(struct scsi_report_supported_opcodes_one) + 32; + break; case RSO_OPTIONS_OC_ASA: + if ((ctl_cmd_table[opcode].flags & CTL_CMD_FLAG_SA5) != 0 && + service_action >= 32) { + goto invalid; + } total_len = sizeof(struct scsi_report_supported_opcodes_one) + 32; break; default: +invalid: ctl_set_invalid_field(/*ctsio*/ ctsio, /*sks_valid*/ 1, /*command*/ 1, |