From: "Michael S. Tsirkin" <[email protected]>
virtio_set_features_nocheck() calls set_features_ex
with guest-supplied feature bits, without masking the value
with host features (unlike set_features which gets the
correct val & host_features).
This does not matter if the driver matches spec, but drivers
can be malicious or buggy and set bit outside the host mask.
Devices don't expect this, so unsupported guest feature bits getting set
can break the host. In virtio-net, this can enable RSC without vnet
header support and cause out-of-bounds reads from short packets.
Pass the masked features to set_features_ex, consistent with set_features.
Fixes: CVE-2026-63321
Fixes: 64a6a336f4 ("virtio: add support for negotiating extended features")
Cc: Jason Wang <[email protected]>
Cc: Yuri Benditovich <[email protected]>
Cc: Paolo Abeni <[email protected]>
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623
Reported-by: huntr bubble <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-ID:
<dfd27c9b26e442a2076f6ddc9bb3d38363d9b2da.1784891251.git....@redhat.com>
(cherry picked from commit a6e0519ea8ed6fc84fab9bf9ca82c7a55780f880)
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index b337c50c747..ddf8c13e99d 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3153,7 +3153,7 @@ static int virtio_set_features_nocheck(VirtIODevice
*vdev, const uint64_t *val)
virtio_features_and(tmp, val, vdev->host_features_ex);
if (k->set_features_ex) {
- k->set_features_ex(vdev, val);
+ k->set_features_ex(vdev, tmp);
} else if (k->set_features) {
bad = bad || virtio_features_use_ex(tmp);
k->set_features(vdev, tmp[0]);
--
2.47.3
