CVE-2023-0330: Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
Other sources
A vulnerability in the lsi53c895a device which affects the latest version of qemu.
The carefully designed PoC can repeatedly trigger DMA writes but does not limit the addresses written to the DMA, resulting in reentrancy issues and eventually overflow. A privileged local user could use this flaw to crash the QEMU process on the host. It is worth noting that the DMA operation is the pcidmawrite() in lsimemwrite(), so the issue cannot be solved by modifying the 'attrs' flag.
The following log can reveal it:
==3850539==ERROR: AddressSanitizer: stack-overflow on address 0x7ffeb10d5e58 (pc 0x55cd154d0f16 bp 0x7ffeb10d6690 sp 0x7ffeb10d5e60 T0) #0 0x55cd154d0f16 in asanmemcpy llvm/compiler-rt/lib/asan/asaninterceptorsmemintrinsics.cpp:22:3 #1 0x55cd15b25676 in sparsememread qemu/hw/mem/sparse-mem.c:50:9 #2 0x55cd16c973cd in memoryregionreadaccessor qemu/softmmu/memory.c:440:11 #3 0x55cd16c6e9fa in accesswithadjustedsize qemu/softmmu/memory.c:554:18 #4 0x55cd16c6cf11 in memoryregiondispatchread1 qemu/softmmu/memory.c #5 0x55cd16c6cf11 in memoryregiondispatchread qemu/softmmu/memory.c:1457:9 #6 0x55cd16cb9270 in flatviewreadcontinue qemu/softmmu/physmem.c:2892:23 #7 0x55cd16cba14f in flatviewread qemu/softmmu/physmem.c:2934:12 #8 0x55cd16cb9ee3 in addressspacereadfull qemu/softmmu/physmem.c:2947:18 #9 0x55cd15ed44c5 in dmamemoryrwrelaxed qemu/include/sysemu/dma.h:87:12 #10 0x55cd15ed44c5 in dmamemoryrw qemu/include/sysemu/dma.h:130:12 #11 0x55cd15ed44c5 in pcidmarw qemu/include/hw/pci/pci.h:850:12 #12 0x55cd15ed44c5 in pcidmaread qemu/include/hw/pci/pci.h:869:12 #13 0x55cd15ed44c5 in readdword qemu/hw/scsi/lsi53c895a.c:472:5 #14 0x55cd15ed44c5 in lsiexecutescript qemu/hw/scsi/lsi53c895a.c:1154:12 #15 0x55cd15eed0e5 in lsicommandcomplete qemu/hw/scsi/lsi53c895a.c:810:5 #16 0x55cd15e3d5c1 in scsireqcomplete qemu/hw/scsi/scsi-bus.c:1518:5 #17 0x55cd15e41f9c in scsiunitattention qemu/hw/scsi/scsi-bus.c:422:5 #18 0x55cd15e33c59 in scsireqenqueue qemu/hw/scsi/scsi-bus.c:890:10 #19 0x55cd15ed869c in lsidocommand qemu/hw/scsi/lsi53c895a.c:869:9 #20 0x55cd15ed869c in lsiexecutescript qemu/hw/scsi/lsi53c895a.c:1261:13 #21 0x55cd15ece001 in lsiregwriteb qemu/hw/scsi/lsi53c895a.c #22 0x55cd16c6ef86 in memoryregionwriteaccessor qemu/softmmu/memory.c:492:5 #23 0x55cd16c6e9fa in accesswithadjustedsize qemu/softmmu/memory.c:554:18 #24 0x55cd16c6e2fa in memoryregiondispatchwrite qemu/softmmu/memory.c #25 0x55cd16cc274c in flatviewwritecontinue qemu/softmmu/physmem.c:2825:23 #26 0x55cd16cba662 in flatviewwrite qemu/softmmu/physmem.c:2867:12 #27 0x55cd16cba3f3 in addressspacewrite qemu/softmmu/physmem.c:2963:18 #28 0x55cd15ed4d5c in lsimemcpy qemu/hw/scsi/lsi53c895a.c:1104:9 #29 0x55cd15ed4d5c in lsiexecutescript qemu/hw/scsi/lsi53c895a.c:1563:13 #30 0x55cd15ece001 in lsiregwriteb qemu/hw/scsi/lsi53c895a.c
— Red Hat
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.0-22
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-0330.
What software is affected by this vulnerability?
The latest version of qemu with versions between 7.2.0 and 7.2.3, as well as version 8.0.0 and its release candidates (8.0.0-rc0, 8.0.0-rc1, 8.0.0-rc2, 8.0.0-rc3, 8.0.0-rc4), are affected by this vulnerability.
What is the severity level of CVE-2023-0330?
The severity level of CVE-2023-0330 is medium (6).
What is the impact of this vulnerability?
This vulnerability may lead to memory corruption bugs like stack overflow or use-after-free.
Where can I find more information about CVE-2023-0330?
You can find more information about CVE-2023-0330 in the Debian LTS Announce and QEMU Devel mailing list archives.