From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023143.outbound.protection.outlook.com [52.101.72.143]) by lore.virtuozzo.com (Postfix) with ESMTPS id 8521380275 for ; Fri, 4 Sep 2026 10:12:21 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=KtqbFvjwoPk+/6NEMRQycDrm/CFwXWQc5j2B5N77BIeFxFCNXDxASz1llzMl3KVGsHekh2g5rk/JC31D5dNoNAG6m9qD9lCumOFxSQ47RJKC1Jmbz9YOj3O9guZWks1MKBy8VR/k8NgGJE+7Faq2Kv4bwqkBOATL1sma63etQJDUlh70oVWnwn4KMKyeri8J9JMCfR6z8ZE/EvcL6fc/h1XRmgF8qovt6BNJSAGmyk5XP5b9cFQpBJx1Nnc8S+JCYXJWsaVmZWSo1uNG6PnogskJUsZpSS2K/9pLeSwCssRGpWUtHYK3ZeddS/PJbBhMoHgyXx2j5goMPeq8lPesoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BP9cjc9UeomC32ikk4g9aMi6p8zTRMTPIBsgM+X3byc=; b=uiAXbGkji/0B7w8oA7iHUolRs171qKre9Qc+BPBXQzHz1mj50b2iTkxgEPWZ9c4ql0d6MT0yVUK3la7snaD+T7Joa9XnYUVllJRASl+FuU4GkIQZ6pydufSOvpAuK2/rKA058HHnPrHOVRJ69z/AEekBDcXN4ON/4vLuq3pRE33M8MW95qVFelc1IJ2v318RUjB6fCJPwe6HBvnI3fmD6vMWvxJppWGRHC8zm5EOhKFgbuiVTXz332StH9j+MNFHc3z6TWir76FpVbmhbay8IG4PVq2bdM05T1YZjzXqHBy74x5uji0Cbc+gzfTUjYPDcyZJvb/Bk23sOjMKE3isUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BP9cjc9UeomC32ikk4g9aMi6p8zTRMTPIBsgM+X3byc=; b=eavfWkpD5DNTDOjbbEzbQku68saV8DQUZ1zsJgXyyZIWZNYVh0sLnyLkOEqdx8goG0qehc7H+3fZkZ+8HBUa0BJMbEEkkyCGmgooZ0b/n9LipF54D7d1SCX+hPt05WbSLWCb0Nf7OJrxc4pmc6di7RYnG+LcTgHLdBpWIQQHmSNGAxcAdqFftwyoAQzO8dMjelpCEYNycEoUOvMiARLFODIgnj+qFx+qdI3ebO/SAJnUka7G9kSstETAopt3IhZoGjrPEkqvMEECe5SNYV0jwU7v6YKMWWwcoYIi+DptEsxo4PQpWnadzRDSx3NI/wgxA5s9QZutIU1PPgJ7FbCnOA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:19 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:17 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 02/15] ui/vnc: fix OOB read access in VNC SASL mechname array Date: Fri, 4 Sep 2026 13:11:52 +0300 Message-ID: <20260904101206.701978-3-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 69e2ae96-9c90-4681-449b-08df0a6cffcf X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|3023799007|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: vnVTh/XI8apyn8pKx9EoaQCGknHWvRoK+MucZuXidmjjrs/Xb3eq2Gzz1VdJ2Y7IIS3mO3eoQxvXTu9oxLYBDquArkDRU3EN095i0sPIN9tt0Cm2636TA2OP5sv4viGjjmbnH3xIqdfb3QheMiQvvvRL6m34Vg2bKv2eRNljwUU7JpmgWsG4eM6wRFLfyGgYpAOemFq6zWImnQuZhdV/oA+P6vO0TURJ3BigpjjOtziRf98tN/0IKc2K+/NICPen8xB7zabP8wLMHVNY/VlENLsoa7yGNCEfQlNIILffneiEisLEReMcLHe/GOw38CBCknDN2Y/hKAQpSHTO7lY3HGgedwllL+7Ktc1bSCSf3SNktJ5Wf20L/vsrIAyX3SwvCHvCn5BG486JXJBUujy2ppxYfXW7gS0dlihy/ceDzBorS2p2U/EjlDA2q7Hh9b3y/bA+TmB4lQ4paRdP6b3jn/Akgi3+5+JyQF2dF3HqrXWV0beMJ2EP3CMZoMXb+q4cU1uqhQUp5xFbOcffu4fIErEHp41C7vFtDJRzvyZzMIjUwb+xNOVLdX+sWeoKYFGGmfrcB8RgTKKTkdCDuplmrTvUnuf5rCs9yJPLtEe+iXzZkPZeWLPmW+DhcbLTprNjS33y/tCXO9niGoa0vlAQRm5vmirpXj7A1ZHvCYh4MLt/NHvmNOSxO2cU71+6EMQiCRSUlfCteSNdxfPH5kxCoBkuj5CkGY/FoernMU1z2p0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(3023799007)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WXpXbVBNUGlGa3NTL0hJSWF5ZTUyUVNVRzEyeUZFMHBOS0JuckM3bnpqUHF3?= =?utf-8?B?RGhQbXk5Y1pZeEt4bC9lT3pPeDdKbnRJL1E0Y3Y1Mis4N3pqL0k5a0d5NzNa?= =?utf-8?B?TGVrMitiWFAwaTF4WHUxL1VkL1pRRnNLcWNQenE2QVV2S3lkY3oxYXJ1b3No?= =?utf-8?B?aVZ6enFONjJoSDNEVENOczQyTWU1bDZFTnBuQmhQdFE5dzRHL2RnZVEvdUdz?= =?utf-8?B?UUFydWU2Vjh5MVlPNUVXZldqZld4NWVES0lWNFE5SlRWZHBTSWpUdnJYRUJI?= =?utf-8?B?dVR1NVd5QmN3a2VvbXBWUGlRSVhUTXNmNUNyT2ZWQmVaR2cxaFFYQWN5cE5a?= =?utf-8?B?QUd2WHcwMW16b3gwMlN4MHRGVnlCSEI2MWh3cWlMaXFoVWNQdCttSVV2VlRt?= =?utf-8?B?NUgrTWs0bDlrV1FLb2ZVSEtPMzRwajViYUVEbHNEdWRQTDI5OHVPb094dkpl?= =?utf-8?B?NTQ1Y0JINDVRcDQrMjhWQVBpOEp0enR3YlRsOEN6QlFEVzdTVG8yanFYUEds?= =?utf-8?B?VHAyYzBsUjZWN3lqdlJJSGcxbHRJM3gyQjU0Ly8wT1MrZGEya2F3cXVpNUtS?= =?utf-8?B?RTZKTU1raDI3Nit5WTZXNUc2WDB1emhybzVFb3JITjNUakxnOHpMSzVMVnhY?= =?utf-8?B?Y21YUE1kSzRYYlk4VUdqT1RUYktoVVRwSy9MTDBheEM5YjVqaWFxbXVSVDlK?= =?utf-8?B?Nk5DRHgwYlhHdloyWFltM2xXUm5aSTNxOUgzVzhLYkJGU1JYVzBrdVd0R1gw?= =?utf-8?B?TDFZSzFJa1pBekFOWklYcTVRNW92UllJbkJSR3pXakhiZXJMVEtaUWhMT05k?= =?utf-8?B?em90bWFhR3cwbzhBQ091ZHpIMWRkQWMvUEdaelVLbWhYS2o5enpBRUtEcVNr?= =?utf-8?B?SXVzWDIvQVFzUGlLNW1nVlR3VjZoMDdHa0pYbkhiK1hPeE1KdW9HSWNJWmww?= =?utf-8?B?ZVdSdmpvQjZORGk5MEYvb01ZSWsrRDRuYnNBOTN5NklNOW5WZytTa0ppSjVL?= =?utf-8?B?Nit5QkllekJ0Q2hleVg4a2M5QkFZVVRPbTdtVjBHbEJQcmd2c0x5NU9PN1NY?= =?utf-8?B?RjRJREROcjM4dHpjdklYWURLQlZyb1J5UmJHTnNzZk4rTER6WlNOemQxMmht?= =?utf-8?B?M2lDSmFVUXhxMWt1c3BxeVZhNkE2SEE3SlZpUGExVzNlY3Z6OW1hT2VWVytL?= =?utf-8?B?UzF2QzVwVGJVUm5iYVAzWTdsa1pKQzhuMmhoSmtmUG1Kd2xjaXBTeXNOWVhi?= =?utf-8?B?UnI3S0h2Z29nUmpVU01xU1l1elk4dTMzUkhGRzlBSU5FVVlZc2ZQYWhKTE1G?= =?utf-8?B?QTAvMXVQTVZkeHJBT0NWaWEwNzhxYmR6QjBHOFpYOW16RUdSaDNpcWJjRU5Y?= =?utf-8?B?OTZWaWlUVzFNbWt6STl5WjJwQ3M2TXZUVFc1aEN2eERqSTBVWnZPYmFiVjVJ?= =?utf-8?B?S3FrK0REcjhWS0NJamxKOUhiU21aZzErMFpGK2R5MFlJSjFzczY3aFhhQTMw?= =?utf-8?B?Y2drTGgzUVZjTFNYc0hBVUllTm5vR1loKzNoaEljYzVDczFRRENtS3VwZGhT?= =?utf-8?B?SzZJSXZnVjFodnoxN2UwRmdWV1lWaWFnWTRNRUpReGZrdGowNTJJUXd1MWx4?= =?utf-8?B?L3NJc3VCQmJaOERQeG5lcndJUWVLclNKa3ZJZHVlWlBDNlFyOURtdWlaaEto?= =?utf-8?B?YXU3b3pjT0hCOVJlMzJmenlBYUQxQ21SaFFYQm5UY3RRaU14VjErZWpid284?= =?utf-8?B?SUZxQzM2OW5TK004K2VzRTVZQWI2dWtZRXo4MGl2Q3JEbVRCOW5VanhqYUNK?= =?utf-8?B?Sm1idTh4MDYyZ0MzSXoyamk4eFZ5VE1XQjUwRktkeVgydEJUK0doK1BvYVNK?= =?utf-8?B?U2MyYkdySGI4cktLL2prZFFqUGFlckk5ME9lVW5SS0s3Q2dxNG9vQ2ZQMVFG?= =?utf-8?B?c2ZPNndJaTRGUkVWdkowWW1lYkl1VFNuWlZRL210RkFPU01GMXNNQmt5dUhB?= =?utf-8?B?YS9jL0tpVC8wZTZUU0dxRVBuQ0o1SW1vZGo5dzFtbG43SU53U1J4emJab3lt?= =?utf-8?B?dVdnM1p6NmFwQXQ2S0ZyWmM5WXNrZmtIRjlHY3ZvVnJyVmNMSWZDd1liY1JQ?= =?utf-8?B?dEFNQjNMaUxHNlhERjQxUURoU1FvUURFdTFKQVB0dXRTT3FuaG00NitHTFF5?= =?utf-8?B?aVRkdWhLM1ZUVlhqTE5URk9FbW5PS00ydFJ2NFJVQXpkVkEzbThqSTNNanB5?= =?utf-8?B?Zm1PT0FVT29idHNVM0RidDlvOENyRGpKKzNlRHgxbG9FS0VuZ0ZBdlEyMXZR?= =?utf-8?B?MVRNS2lSWncwMnhpN0c5cEtPOHRTaXZXY1FpWjFJQ2pzVCtZcUFwR1VVQTBT?= =?utf-8?Q?KDSlIF5LEO31RRDg=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 69e2ae96-9c90-4681-449b-08df0a6cffcf X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:17.5930 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dWSRKw6Bmqxp6jhlieOugh2IOZg+y21N9IZ7qMMDbICA/S0MHl8ETIlTvWGewQLA7UF4hl+vcPdi+A2/OBiETGnrpqSDC3PMwBkGmz3LKy4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Daniel P. Berrangé When reading the SASL mechname array off the VNC connection, if malicious, the received data may contain embedded NULs. If this happens the memory buffer returned by g_strndup may be shorter than the original data. Unfortunately the code continued to index into this buffer with an offset equal to the original length. This is a potential OOB read of the array. Fixes: 5847d9e1 (ui/vnc: simplify and avoid strncpy) Reported-by: boy juju Reviewed-by: Marc-André Lureau Signed-off-by: Daniel P. Berrangé Message-ID: <20260521103353.1645561-2-berrange@redhat.com> (cherry picked from commit ae18df638fb4285c7b645f98c43f5ebc2e123a55) Signed-off-by: Michael Tokarev (cherry picked from commit 3b489576ee4d64247731553157443f29e51c7716) --- ui/vnc-auth-sasl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c index 09dafba18d3..ab8fb42dd84 100644 --- a/ui/vnc-auth-sasl.c +++ b/ui/vnc-auth-sasl.c @@ -490,6 +490,8 @@ static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_ char *mechname = g_strndup((const char *) data, len); trace_vnc_auth_sasl_mech_choose(vs, mechname); + /* If 'data' had embedded NUL the dup'd string might now be shorter */ + len = strlen(mechname); if (strncmp(vs->sasl.mechlist, mechname, len) == 0) { if (vs->sasl.mechlist[len] != '\0' && vs->sasl.mechlist[len] != ',') { -- 2.47.1