CVE-2021-3607: Input Validation

An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device. It could occur while handling a "PVRDMAREGDSRHIGH" write from the guest due to improper input validation. More specifically, the initdevring() function in pvrdmamain.c does not validate the guest supplied 'numpages' which is subsequently decremented and used in pvrdmaringinit() to allocate dynamic memory via gmalloc(). This could result in a NULL pointer dereference issue (if gmalloc returns NULL) or allocation of large amount of memory and out-of-bounds read access. A privileged guest user could exploit this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

static int initdevring(..., uint32t numpages) { ... rc = pvrdmaringinit(..., (dmaaddrt)numpages - 1); // guest may provide numpages = 0 ... }

int pvrdmaringinit(..., uint32t npages) { ... ring->pages = gmalloc(npages sizeof(void )); // npages may be -1 here for (i = 0; i < npages; i++) { ... ring->pages[i] = rdmapcidmamap(dev, tbl[i], TARGETPAGESIZE); ... }

— Red Hat