From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021079.outbound.protection.outlook.com [40.107.130.79]) by lore.virtuozzo.com (Postfix) with ESMTPS id 909C4804D2 for ; Fri, 4 Sep 2026 10:12:23 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=phDXGnGJ2/YuqG81UdU+CbhgpnoxK4WH1oF0brLekbfbyD+ZThpjvJ3z78c0asUP3xQDcR+DexbQalairF0mT2ulluz7iJO3kOgt4L5IQ8sKzYKZL1fxMLFkDUxZPb3GZ/7+rhLh+wXA/8xTURKnz1ywJyTuSuCex36mjLnrlVJTaKxzmco9G6iKcOAc3GMIXBRwbE3Cb3Wsa65mPjAMadSuAqaXVy5tAbVzmmMA/MsJv76+ZJJZD6WM3YWxAB86ANSU5ADfU//z0fSwwtXK17kDqlcJ5WrG/PxRQwim35uNAMB4CSLc2P5XaExYu2n8bq4AESNT3gHgFsw17goIwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jyxYbkm9G0ljy3QNzp4eSUtWjEWtKX9QuLGkWWdxPtU=; b=N+926sjeV4aP2MZVsNXPLaxzfIZOJeG2HNjteCrINJaxkQEzK1DX1QS8sZPpNltQEF7Qfep8HuXujcV8yjyFUbwZH8FnWxxKnPlbntaLx/UI9oUu2nuELMTWi4clwIWZY6Q2F0rxeUoldrQIv0Pb6JQks4Ksx/sY74DeJ5EFN4TSYKN5B2ZQvAjAQtYRW0YSjGVmY8gyFUbx1coMQuCWQnLbXE8zVNRBVLr9uIpi4n6MbsmMziChJiyExKYDMO/SGSbksmrk41q+WlPoMfJsaXvXyBXd81G311m3iblC12O5haRxZc/LbWwrgCeKUTQ/iAIXpixGGFhrX6VHt/y9Og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jyxYbkm9G0ljy3QNzp4eSUtWjEWtKX9QuLGkWWdxPtU=; b=kW8SjbThY7a7tllxTr/EZQnOLhYRO6WBYb+NydLx+a2KVtezICjiMLgB6mRbQNIBsw+qVk5yl0uvEQKYn8+8Gv3SRF8EqAVR67hnxYfKInDagYflbgVs6+Ghj+D2Ny6AuXAZ2MXYcOm/OxCu2ezOlpB3A9vyujg/aAxbtVJfJqIssAEQ/NqoZoyuZpXXtyqB+c0AFa3bLenE6ePt93UTLpfA2pCkXECi9gBYEn+x/0BOuIUz2ysrqHzINUtyc43ZiB9oMdruqOFcKmOg2AgB650bXfWNwvrJoKz/Yafx2SQoPk6s6JRwPi6SvL4yWUToZVmbGN+Sn+7iSNOtWmxaTw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:22 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:22 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 05/15] ui/vnc: fix OOB read updating VNC update frequency stats Date: Fri, 4 Sep 2026 13:11:55 +0300 Message-ID: <20260904101206.701978-6-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: eed2cd90-7b33-4721-7244-08df0a6d00b6 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|6133799003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: dR/CofkLi0qhi0r5w8MwkYnBLLihtVgvt2bXA3tBmR0nO8CaiRKhV5vRTJvq8h+lcfgebOR6P1zaOU45VHegtBWR5y4lre1MvvPiQLdf08He7Bq1+Hzi5BCZk2nM8KVm1/lip9NXz7qG+pfnQyqycKSYNrSbhDclR3xbEcxyNYB6fj7tPB4JPSk8dWPrZHIfYgYCaS9AV9pETaBTIQGh2BYWJiTRjsmVqD5fe0g7MKHYR4hY+az72ScJ2wEkgSsklYt+BGejlPmnBkyVDDjo6ukTjrEHY/X5l/WCKtbz7vXYcyjpVOCdPdQB4U95Gsf8a7CQ8q35ls6QZdokkXZRBwtXWxsmXrIxsuqkmWtnMwJwDwPqIk8ppx7cLdeKBBaF/bbiuYSCSZ+j0uiJNtlBQVOoEI4/zle9jeGC/H/YOT/3YqZz+0xqET1ydkaHZbyM+Cf4pvXTP+ED+86z0lHDXfGDsC9qPvFfxNE/62SJaAmVkp5AJGZx/VUYjsDvld3Md1F8CNCk2nMKGgahRPRdb4m7dPuXx1bJ1HyvBmO6j0wXRPRDAgYDQOtoizHzx8i5jbUy0gcxhk+J5x6xXJmpKJsm0Eno2tKziYp44o0bnTv+O8n2/rI9BtLuqafJqPP9M8+fCk4jFb1TDZiwWMJgtR59dL3ieyMr9/SUwEedhe1F9lJ1u0OTfWcm9jNyzPQlUMRAJ4zofi8beon1/E9R5Jq7+E7GU3GzZ4gBqmuWKas= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(6133799003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dU92eGpIL2h5b25sT21FWG9Gbk1mZ0NpVm5qNDVzY1pxV0M0cjJzWU9GNWdW?= =?utf-8?B?Uk02Vno5ZTRCNFVhdGxoRW9wNGlEOG1CVkFOMFJ3WWNGcFRQWkhzNnl0MnN3?= =?utf-8?B?MFlXay9lSm96Z2tyaG9yV0hCNUtwaUcwN0NTamRMM3AxL0duSXAwSHJwOHdn?= =?utf-8?B?V2NlUEJENUdkTVo5QUtMQlN6MEhyTzhVUW1KTlkrQTRQbHRTTytpK2xrYWtH?= =?utf-8?B?QlMzNEZwL2huWXViVDA0UGJkWDV6ZkNybXBJaC8wNm51Nnh3MS9qT05hWmRy?= =?utf-8?B?bVRLU05wNTR3bkhOdUxhd28vUXZXbzNKd2N4bUFPeHJSaXpMQ0NzRDNDekhC?= =?utf-8?B?eTRHTEpjVWRPaHE4TEg5WithWTRYRXdhZlVQSmwraG4yci9FcWVjbnJLMGZC?= =?utf-8?B?eTRCRFdmTnVGNjRLTlJwekJ4aWNSUWkrYkxQbWNDcTdTYldyYW1qOGZONUQw?= =?utf-8?B?MEhLcmlTUGxuUWxKam5QNWROQ0d4bVpIb29FTVV6eVdNUGJYVGVYRzdjcnli?= =?utf-8?B?a0RxWDZ0UG9TU3FIenBxRE1najJBQWVwaDZsRFA5NE1UWVBkWEY1dGEvcXJp?= =?utf-8?B?WVYwTlRWK3ZlOGhrL0t5YVEzMDYwNGFGS3Q0L1NzWFhvWUs1bTNDU0QxK3FM?= =?utf-8?B?blErVmk4UDhMbHdNaFdvMi9LNGtLVGFJN0tRRUtNNlZwVkxHMi9kSGliYXR2?= =?utf-8?B?RkljNU53NDNDcnkrUysyZk0zL2ZrLzBLRkFDeC95NWlWaTRWVnljdm1HNzJi?= =?utf-8?B?YXl0YmJXMWJyc01lYVIxSVlBQVdLcnNXZkplL2J4V0ZsbUJidlFmTUMzZnBp?= =?utf-8?B?K3NXaCtSNnAyUnc1a2taOGZTOEszRGFlYUhNVm1QOEpSZGw3SHBWNmQ0NVlW?= =?utf-8?B?b1VWWlZIcDNMYXNQRnp3akdocGVNb1hjaExSQjllNGlOdmk3bFlWOWZyNE9Z?= =?utf-8?B?MVIrT0dhUzRkM1BWZjE5TTIvREpjQ3o1Z1JTQjZiZUQ0bHJZVmczb281eWlB?= =?utf-8?B?T3BLUVVidzVzeDNSK2MxeCt4MVJ5L1BPL012THRMTWhiL1hQb3k1NXZhaHlk?= =?utf-8?B?V1YxR3VGanhrMXUwc21ZcHphVWQvdXdzYmZhZXFjQ3hRbkFocFNvT0Y2VVhP?= =?utf-8?B?SUFuWS91anljUlpmVG01Tk00ZVpzK0pMM0pPWnJldEtiUVFPV0NyT3RnQSt2?= =?utf-8?B?Z2JvZDVycnVvZEtmeGk4VGZWRUgvVUVSZVRLZmdUWWtQWG9GMFJMMC9lOUt2?= =?utf-8?B?b2dLTGxDOHl1ZW1IWWQ5UlYyT3ZVbG5RbjIvK3prMmZ3ODZJVzlDek5XaExh?= =?utf-8?B?ZDhWalE4ZnIzWTl1TVdsK1c1V0VwTzY4Q3FTWUdDd2JVS1pyNC9BcEdaOG1n?= =?utf-8?B?K21kYXRWdElzSGVJdHQ2bGl0WmxEVzNpMVJxa0Q0cm8rdUhqSjFvVEZvMjdR?= =?utf-8?B?ek41V2hjcFB1UDBDYXdWUHVwY2tZTUFCenVxakZqQTFvZGFqNjhRY2hsMmpP?= =?utf-8?B?bTdsMTAwSGsxdlc1ZmRnTnRqNXFrcHN4SWRHcjhJbTVSSjRXdHliTnd4UXpZ?= =?utf-8?B?dWhsRXJ2REdQV1FLbVdnTm9mQTdwRmFRUXV3Q3FUMlFEV0R6QjM2ays5Z1hz?= =?utf-8?B?UkZrMFhnSlNnTmFHNUJwd0p5UjZJcTBlejFoRkIzTmE5ZHJwSnBwbFc0S0pp?= =?utf-8?B?WXR1YU04TG8yRTNkWHhhWUFMcUFQV2kvQ1U1UllLMFZ2NitkNEU2eGVJY1Q4?= =?utf-8?B?WHVzOFQvK1RDWDRham1QWTh0V0xLaE9UV0FDYlMyUE9pQ0ZGUklXUHN3cFBV?= =?utf-8?B?ZmpCM1JLUFFoeDQ3Y3U0UlRBRnBib2c5bHhNU1J1M3ZRVkhQYjM2Sk5uMXE0?= =?utf-8?B?OWhZZHZOcnA0S1UyeExNNG9nKzcySm4zZkI5UUlnNU05OTV6dVVybVJmdldP?= =?utf-8?B?cERJYlNGdkhzZUhNNXRRWE5aTDdDRytTS3AyNm0xbGk1czBXYVk4QmFkemdH?= =?utf-8?B?Vnhwb3V6MVhhT1h5R3k0b3BLaTJMWWlZUU1CQlh0dGNxWDZmamx2L0Eyd0Y1?= =?utf-8?B?OENIQkZiRm11MUZNVjZnNUQ4SjY4QVFtK3RLNm5HRHVlMnVIL05oNkZYaGNm?= =?utf-8?B?WG1teExBdDA4bWgvSko4ZXRvMjA0a1VvOXlCUnhxZG9LOGRIaTBCVkN4MTFD?= =?utf-8?B?ZWxON1UwSnFvaWY4OUpmeDlFS1poWjc1OGcvV0FuY2pUMmFQcVB2L3p3aHJP?= =?utf-8?B?aERVeTRRRGJmd1FWWnRTY0JVZnVwamRZZHROaXJUenBKd01Jc0dHVXppb1dF?= =?utf-8?B?TVpKR0I5b3QwcWxoaFFtNXVENEFBb3A1cDZnNHdhVFJqeisvYkdxdXJ3clA0?= =?utf-8?Q?ZIAGe6TvrZ9+kTvg=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: eed2cd90-7b33-4721-7244-08df0a6d00b6 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:19.2337 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: VSnhwr6YdEOOn1MXvkNenjJWGCeQHar/MeWC0WMEjrt55oOemkzPsDYt/CYlKTHGbQWWWka1w81opi0O42XXas5+f9fJveaIol9IZTAeBFc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Daniel P. Berrangé Incorrect loop bounds in vnc_update_freq result in iterating past the last row and past the last column in the VNC stats array. With suitably chosen dimensions this could be a OOB read that accesses memory beyond the VncDisplay struct that the stats array is embedded in. Should this hit a guard page, it could trigger a guest crash. If it does not, then the VNC frequency stats will be updated with garbage. Fixes: CVE-2026-48003 Reported-by: boy juju Reviewed-by: Marc-André Lureau Signed-off-by: Daniel P. Berrangé Message-ID: <20260521103353.1645561-5-berrange@redhat.com> (cherry picked from commit d0c7b82d3a89dd9c863f8aa69b07360c648ca9fb) Signed-off-by: Michael Tokarev (cherry picked from commit a625c70daf64d48c3a86bd50e948ccab69f297aa) --- ui/vnc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 7373c83b692..abc83a46e32 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3116,12 +3116,14 @@ double vnc_update_freq(VncState *vs, int x, int y, int w, int h) int i, j; double total = 0; int num = 0; + int x_end = x + w; + int y_end = y + h; x = QEMU_ALIGN_DOWN(x, VNC_STAT_RECT); y = QEMU_ALIGN_DOWN(y, VNC_STAT_RECT); - for (j = y; j <= y + h; j += VNC_STAT_RECT) { - for (i = x; i <= x + w; i += VNC_STAT_RECT) { + for (j = y; j < y_end; j += VNC_STAT_RECT) { + for (i = x; i < x_end; i += VNC_STAT_RECT) { total += vnc_stat_rect(vs->vd, i, j)->freq; num++; } -- 2.47.1