linux-kernel - RE: [PATCH v4] hv_utils: Add validation for untrusted Hyper-V values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 13 Dec 2020 22:07:06 +0000
From:   Michael Kelley <mikelley@...rosoft.com>
To:     "Andrea Parri (Microsoft)" <parri.andrea@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:     KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Wei Liu <wei.liu@...nel.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        Andres Beltran <lkmlabelt@...il.com>,
        Saruhan Karademir <skarade@...rosoft.com>,
        Juan Vazquez <juvazq@...rosoft.com>
Subject: RE: [PATCH v4] hv_utils: Add validation for untrusted Hyper-V values

From: Andrea Parri (Microsoft) <parri.andrea@...il.com> Sent: Monday, November 9, 2020 2:07 AM
> 
> For additional robustness in the face of Hyper-V errors or malicious
> behavior, validate all values that originate from packets that Hyper-V
> has sent to the guest in the host-to-guest ring buffer. Ensure that
> invalid values cannot cause indexing off the end of the icversion_data
> array in vmbus_prep_negotiate_resp().
> 
> Signed-off-by: Andres Beltran <lkmlabelt@...il.com>
> Co-developed-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@...il.com>
> ---
> Changes in v3:
> 	- Add size check for icframe_vercnt and icmsg_vercnt
> 
> Changes in v2:
> 	- Use ratelimited form of kernel logging to print error messages
> 
>  drivers/hv/channel_mgmt.c |  24 ++++-
>  drivers/hv/hv_fcopy.c     |  36 +++++--
>  drivers/hv/hv_kvp.c       | 122 ++++++++++++---------
>  drivers/hv/hv_snapshot.c  |  89 ++++++++-------
>  drivers/hv/hv_util.c      | 222 +++++++++++++++++++++++---------------
>  include/linux/hyperv.h    |   9 +-
>  6 files changed, 314 insertions(+), 188 deletions(-)
> 

Reviewed-by:  Michael Kelley <mikelley@...rosoft.com>