From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023141.outbound.protection.outlook.com [52.101.72.141]) by lore.virtuozzo.com (Postfix) with ESMTPS id 0545D80275 for ; Fri, 4 Sep 2026 10:12:22 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yCCKfTEajs77B39ti8zn0cRT4RKr1LFy1hElR9YJcCEL0B6ev+nWD9DaHhBdtPxhjk6X8Ij9dAxr3AoFfw1ptABI4iG/zsfy7B4f/wOdJG20GPzIElpYhY89hKsWfg06Xv6Nhsopb2kwrfR09pflXZv/p5haE0yeJXIQ7D5m9IctxAYiz7GX6H7pOVF8Ym4T7HTTox8dHSgQ5CXIbJi0+j205C2H/45D/7iId185X4i7MkHaE3XdA2q7Hho8qiCsJr55Pi1mx1CoDC96lN3WgocX94QqhPHZjadDSGq9u92ZAuwXG9QpN8we/pXHjx/6fiuKL9uAbjiMOldrtjM2OQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=k4lwK18SaAwSuilzzIhxBPutGmZbTN6Y2Pu6osxSxDs=; b=KlQzvjlH7RMYYWbG8pjn4DWmw3VTwSc5kuGgqx3LobBPD8CSqhxVVutCd6y3CjmZrk2Cdi20LjuLVjiZgoIN9zlWVri7wnKPIxeRV3S/Md2hjpVHIegRFc2+/hTnktjGAoR+HpV/BITWqwDlaq0QIuzV+R6lOeXZiu6tkeoCF3Yanry+Fg9j9Q1DB+61ZOgHt/bDLCBesUykB5JFrzs2J3UtPZ0WXIamlCb1slTkC06O/NCSTz9GWAoEo9POOMtLRx+gv2PALi5z+DiruJ51AaX2CD2xVC6KPQ/8jgQtPAZGjVxOZ+OxQ2zfHXjQqsL+au9BTMeYA93IRq0HWDmqIg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k4lwK18SaAwSuilzzIhxBPutGmZbTN6Y2Pu6osxSxDs=; b=JfKWNThAAqGOqK8ZJdHNj7b8wI699aIH+LFHpznyadKQcUxVtB5bHWw8HQ3rxjFFCQEFMyiqbNbb/sx/3FRjCjR3CSiXFii9qhZIbvYrUC/pZsBQVQvSw4mzyG6T+YJL6kSI0Hduh4RBbplCjgW8vB5hW8j7j80xuj0FtAcW1jz1JDYZ+GLbXM/om8wv8ogxr/n5s6NcvRpzyK3tJ2yL4dV/3DmQAaNcWCcjNy4RpneyBi2E6pFo2CQ4dGOyRtt4/rjLXjxEY2EnYIzSponkt9ifGS7D8CD50KPv3JEqT93hTtyYhlJaXGtnqYOdN0vmpLl45WChOcTlAn/IBNkT3g== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:20 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:20 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 03/15] ui/vnc: fix OOB write in VNC stats array Date: Fri, 4 Sep 2026 13:11:53 +0300 Message-ID: <20260904101206.701978-4-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 46c71fbe-8cec-4782-b0a9-08df0a6d0014 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: eAHluwH4hWS+okBF3VW84CjpfQDWbRdMSSDb8v5u+kyMJmbn70D4R/YL3i3dlIAw2W9CoBvMR2ps4tUdDYpT5wWgYkVAh5gKiC4BLdJ9YN0XeEyAlp5yTkYcqqV32ajemPmtEgelYZFjiykBQSj2skOmzn/PUpvfPb5pEcwfXlPcDDzk0pqgFIrgGRDFOb+wkAxEFopOVtLY1pE5sfOthmjE9FvNqboqSLQ4T4r9Ma7vkAfqYNVE5XJVJs4jc5Kv78jvzReFEk1Dpz0qjQX5W/tZqtfBTf7Hpj+NzkujOtMv0ib8tj7oWBk7OGi7E3VAn9Cm2D6YRM3xPfQcqHdkKU9IQK0QYc0H2z9SuqWSONv/uYYMcpytdCIgjvlXR4+86wTWUsgBFvJnf2Zotayaa9FqunfBEz8NMBbZ8EJ0JZmgNKQjp7G1KW/sYhxV5rtmv/bcjTnunUi53gQrD5mkIPmhH9GROg2fomFrgtI0rl/9Oq3oSz2rNeB2GPvu4o4D0WaLSSsMaGe1H/0V3jUiFrT9to4cI2tPh5alLfEnlGR2lkRVnQH1Zbj31ezX+b6XgvI84UUBJVRCPDkyjWguAphnyda/blAxN2DYIxOHgo2ms+cKK7Wb16VXQyabmEzoYMXXjvklgtGd25HuIr3oiuxAw0FWMvN7A5fob/dmmRWb4EKxKC/Ls8rzBJ2XOJ8mWvRTPfHeiDZ6/Vd1bQalbC+o2xOWNPRwKp9ag/wjH5A= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WnZhNUc5VitETEYyV3k4dTArbi9wL0lIUWVQQXY0cHBTV1k0dExwVVpIVGpU?= =?utf-8?B?Q0VucDQ3L2RDME5nZ2Rvdno5cGlPYnJTbkcyVUhSck9kQWZOOStoaHNzY05n?= =?utf-8?B?bk4yL3cvRkdXMHY2djhSS3FHWlFaSUY5bk4xeXV4S0NvSlZwL1BqYWFoMHdm?= =?utf-8?B?RDBuY29kdGJ2cWFQaTMzbFE4OWxpeS9pZWowWFZvMnUzeS8yYUtXZFNmSXdP?= =?utf-8?B?OVJGVW9SZmxTejZyTDQzZitLZzU3VXhsRWh2TUoweEc3Z1V5dHA1cVk1Tkhj?= =?utf-8?B?cjNTVEwrSEovakZHYTN1azZkaDE1NHJtSVVVNWhxSnlFd05SYzdkM1hPdFQ1?= =?utf-8?B?bElZNXh3aTBKOFpxSllReTF0Ym9qVTY4dG5sZFRGcjNIeEpkMkVrNFZWSXU1?= =?utf-8?B?WkVDZ25VaGl6dmgyU1IyR3IyejloRzR1Y2NTMEpGWDZrWFBBa0pIN3ZZRi8r?= =?utf-8?B?K3BCRjZ6elRYVFRzeStwQm11WWVzQ3pzbzhDQXdwZG1IanBNNG1uS0tGdXZl?= =?utf-8?B?RGNYNmpGUlhlNnc1amFsOFArb3hFVnVWOGN4WWsrTGFWNnNnd0VUWUZYbnBK?= =?utf-8?B?aG1yb29BZDNQaXdOWkJHMHVIWFlHTFBtdUJhRXVObUcrV3o0QW01L1J2V1Jh?= =?utf-8?B?V2hOVnYydWZubTBpNitQMFNNWWRZQ0FqcFVqYWNYMUtxSmJnSVdOdW96ZVRn?= =?utf-8?B?eGNPRjM3Wkc1ZnBYbU4rNGk1TFROSkpwUSt2UlJsMnVBWGVFdVJIRW1RakxD?= =?utf-8?B?d09PU0diQ0VCQmpzWE5qWnVqT3JPcjVIQUtmNW5MaURTd0xlRjk2SHRMeDlB?= =?utf-8?B?aW4xcUFUWW1scVJGMUdxUkI4V0x3SWRsd00rNm1YUE1WczduYmJOQXlldWU1?= =?utf-8?B?cTR3N1Q3QWVBdzVNQlFtYW9uVCtycXE1UFpINTdZSTllNE9BWnBLbEdlT2wz?= =?utf-8?B?dC8rYXI4Tnl1OHhpT0FjNkRoRld6THp1cDdnNkt4c1Y3MlozZ1Q4aGNaOTZr?= =?utf-8?B?a2cxQnBlakEwclcyN2xLek9vZkpkZ0QzZzJvUVlnUEFrckZGQURwUWM5WDc3?= =?utf-8?B?Qm16RGlUSENQaEdyM2dBSVVXeno4cDZadTZDZmlKM0VnVERySXh5allnVU5y?= =?utf-8?B?U3FxTCtzTU9taFd1ZEtGdmxELzRrbjBrTFd2OEhQSVFYWDRFdWoyS2U5YldO?= =?utf-8?B?U01DSTA3TS9RS1Bod0hNblgwS09INklHc3FrQ1BUc1d5T2UxSHZQOWtlUkp3?= =?utf-8?B?emlNTHVhcUZwTHU4aVQweGNuV1NGRlFkZkpqUWdSRUtzb3lYNy9pOWFhUnRO?= =?utf-8?B?akQ0MFlWdHY5RjZ6d0UrTExRKzh0SW5qTzFQc093T1N2d3VHcUV1em82d3hi?= =?utf-8?B?V29Cck5LcUliR2N3S1NLaFllM1VpZUFZQytlRzNOYkxWQVduaEd3QmxjOURJ?= =?utf-8?B?dGk4d09DS1U3QkFCSVJMK0RYeVBsRWZIUlJsNllka2pzMkRUOFpuZDNFOFhK?= =?utf-8?B?ZFJ5bGx2OHlxSy9NVldlTVBOcHY2UzNhTjZKeFpDRFVhL3JtaTZhaU5oQjdj?= =?utf-8?B?YzNvdmZlWU9VMk9PTm56ZXZraGNFOW4vWTlENE9YelU1eHJ5TEFERlJodkxv?= =?utf-8?B?NVVBWjVObmNhMWtldHlkaC9mUzdrZHdBdndBQS9ta3V2YVpXaDBKRzNXYksz?= =?utf-8?B?NnZMQklhS0xscUFrMXQyUzYwSlNUaXdlbSt0bUVDK1B3TCtUN0UrUzRmK2VR?= =?utf-8?B?TUdMZndMeFNFaFlEbzIwTHNEYjFDQ0lQeEtUc3RrZnVvY0RkT0V1V1p3NWlU?= =?utf-8?B?R1c0SjJlUURjZ0ErRGhSampXNzNsS09WTjZCMjB0czVNaXBmNHJmZVl5eFVu?= =?utf-8?B?QlBURk8yeHJCa2lUZWZUZmxtVnloeVNpYlVZbGJqZTM0ckQ2MEljK1dGcmRF?= =?utf-8?B?TzhCMEVDUm9vbmF3N0I2aHhsVHBRWDkyQWRRTG9hYmUwRXlBSzIrKzk1bi9X?= =?utf-8?B?N3NzWjREcFFLUzhZYkxHakJxdzV4RVoxamp3YXFkQVdrZzhxSXFRSjlnSXJ3?= =?utf-8?B?QkNEb1F3VTJoc0hCcGVKZWVJUzVtSjhGQXFTTGloMnU4WnZtT256dnFyaGJv?= =?utf-8?B?ZDRENEhUUTFqSDREOXU3VlduYk5xRWtaV2xOYm9SSElneEZ6OXpVTVREZjBv?= =?utf-8?B?NS9MbUc2SFhPL3B0Q2M3V1BMM0FWTFRzVkF3SHh4RndpSEh2VjROMm53cmh1?= =?utf-8?B?QkhINVNxakRGeHJ2WE95eVRGM21iemFJTENSbE9LMWhTVGpydWR6OTNOeXNz?= =?utf-8?B?c0tuS1FEdGE5L0o5T0RLMmdVNFVoZjN1R1pyWmpyS0RFb0hqWVhXd1JLWXpB?= =?utf-8?Q?S1IhNTijkHv/YLII=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 46c71fbe-8cec-4782-b0a9-08df0a6d0014 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:18.0995 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: DdYT/gmLQajE3E35acuGYr9Xs/CPfmkrjEw98ha+fExXBSFifoRcv4ASDAaRDQbAPUGx0tdZP0SUdJpVEUQT5HEFgolkT+qk35leb0JHiBA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Daniel P. Berrangé The VncSurface struct maintains update statistics in an array: VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS]; where the dimensions are defined as: #define VNC_STAT_RECT 64 #define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT) #define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT) If VNC_MAX_WIDTH / VNC_MAX_HEIGHT are not an exact multiple of VNC_STAT_REC, the COLS/ROWS will be undersized by 1. Unfortunately: #define VNC_MAX_HEIGHT 2160 is not a multiple of 64, so there is potential for OOB reads and writes in the 'stats' array, if the guest surface is over 2112 pixels in height. An array overflow occurs when vnc_update_stats() records new statistics, either scribbling over data later in the VncDisplay struct that 'stats' is embedded in, or performing an OOB write on the allocated struct memory. Fixes: CVE-2026-48002 Reported-by: boy juju Reviewed-by: Marc-André Lureau Signed-off-by: Daniel P. Berrangé Message-ID: <20260521103353.1645561-3-berrange@redhat.com> (cherry picked from commit c3c6226fa48180edf9d4646d4112fb1becbc149b) Signed-off-by: Michael Tokarev (cherry picked from commit 4f22b8179f5fc9bf3b2e0a7d9ee01c3a4d6ba664) --- ui/vnc.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ui/vnc.h b/ui/vnc.h index f2dab2f4d96..102648e70e0 100644 --- a/ui/vnc.h +++ b/ui/vnc.h @@ -92,8 +92,8 @@ typedef void VncSendHextileTile(VncState *vs, #define VNC_DIRTY_BPL(x) (sizeof((x)->dirty) / VNC_MAX_HEIGHT * BITS_PER_BYTE) #define VNC_STAT_RECT 64 -#define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT) -#define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT) +#define VNC_STAT_COLS DIV_ROUND_UP(VNC_MAX_WIDTH, VNC_STAT_RECT) +#define VNC_STAT_ROWS DIV_ROUND_UP(VNC_MAX_HEIGHT, VNC_STAT_RECT) #define VNC_AUTH_CHALLENGE_SIZE 16 -- 2.47.1