From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021079.outbound.protection.outlook.com [40.107.130.79]) by lore.virtuozzo.com (Postfix) with ESMTPS id 51CE780275 for ; Fri, 4 Sep 2026 10:12:23 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Yvmc/ELcucQ0UuP/mwxksqWKl+zlAS5Lmlit3tJQICf1VTCO1Y+3RBQTPSTLUXZlHDEPFy0aGRJQHBXYBwLGa9Qo/LOqnLYayNbDJYaSiNvYA3p5IxmrRTO2Ow8hDOgntmyhkkFrh/KD7+1ckiAHv6o/7miu8RAe7LcCDfaIghvIpurBALVJXQNYplBAUzBdVGc4WH0dTbsZI0YRqQIv52hnd/pBZr6UlIVUabPfwMSEsvBrcgB5cliuvG1P4st3bhGT8xlV1jYYLHkG/dgCGc0HIvyAQlxnP+nFkfJQsZIfVvcNmazcCLTZyBG9v1VSQaEj05AHlOrJJkNk1vcB9w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cARa2X53sakpHde2AdO0Gs7pc9qIgXeOvA0IZh6GkP4=; b=RGUAXHjVxIIU1RCD1p+xCWEQuf+DqFFEPfmfAmUn/0knrbIG2IvKnOC7kXPIEyvlUSeUg1rfSeiGTAPZUyByKfvEO4UB9MoNXJSx3CkG8uykzOEKvZgQbEyPdM6baC5kpdC5n2g+BJtvUd1SRJ501oh8qCkPid+WQ690DkYrOueo1NXSpHVwYSxciXxdApK9DeGgRjLu7qPXIPalxP38e1bhdNwRUFBItKPNNR4r7hnLmVxVutT+vXA7jRythFgDiKcYYgwnt8/WzME6oCee4l/w10CoPEl7apXeg4w8BCapE56w94GcnnzN1iab50bSs3U57gp1SqrWE/sPMp/x5Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cARa2X53sakpHde2AdO0Gs7pc9qIgXeOvA0IZh6GkP4=; b=W6RwS/7n0zRxDlUVAkQT709E9UDbZGaHfs0AslhBJZVZOR4bvxpRypC+LHPu3HNgaKLhSUGUpCf6iaq3E9O8SJJMDNa25FQei8q2Yk0SizZUNFgbAZBdQgs+YtgnSUFmuKhc3XvLEevTlK5tuigv2NNC8HxvzdM9DHVc0pXnf1x64KRaXhL3bEsmHeq/OFbznJejKql4Fl16HWVd97GDERUJW4vN42naNfSUZKlp3eqm/G9si1mXDjXrTT1FVixRwRBuRdITsIQeUNZ03Ch+gQou8yQXJI+yqXTrRd7ZUM5CKvylrQgQBDicfJjVrETMusWfoUX55l9WUn4usje+Xw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DBBPR08MB6105.eurprd08.prod.outlook.com (2603:10a6:10:20d::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Fri, 4 Sep 2026 10:12:21 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0382.007; Fri, 4 Sep 2026 10:12:21 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [QEMU HCI-8.0 PATCH 04/15] ui/vnc: fix OOB write in lossy rect worker code Date: Fri, 4 Sep 2026 13:11:54 +0300 Message-ID: <20260904101206.701978-5-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> References: <20260904101206.701978-1-andrey.drobyshev@virtuozzo.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: VIUP296CA0052.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::10) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DBBPR08MB6105:EE_ X-MS-Office365-Filtering-Correlation-Id: 0b072614-acbf-44ce-ee12-08df0a6d0063 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|52116014|5113699003|6133799003|18002099003|22082099003|56012099006|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: Bz9OkjVPVe41VSXNz3GumAJtExSOVL3mIm7XuY/Yj9dQR0zGqYJ9aJNzyxf5fTC9mky14KDNdWoYGAKwtIukpblOb9wW5wejJJ/ihgIQBCe98+bpvhUf/WVVHNeOptN1JRKQfHewsrcM80sccfFktY+0k53G1Uin8uYE+67W22a340ocT/w+OkLjx7NzRd24p1v+vP9SzpiaNIgqkIxfjEyi2Iq+yqvkm9mn7R/IF4uGFilFVG8jL9qYLIFjdJJEotHoSUu8I/1ZPOmcgzRARasjw2wsZFi4fpd6sAXUWHd5nLJmw47UOcEaW/9Hgi0smbRJcVeiXeUtnIjM4t1fs0Cg+sVXNNrTvSI6XwJCXHhoRMZQtKzfBhlyGdT9mGN97RU3B2Uj6O6Hx9rjKdpcXC/38WgATTt1FgZwSsh1Y0f+JX0PLuAxRg6Nxzt4yWxqvd1DfGeYpT5TRM7vnkEhX3NZTF95PZRLJJ3HbRQboIlJk251cwJOjdkM5Rhvgb8PsFP6Rxj2skkxH+/I/okFr5440koozVVy1LxR25ZWwBqAd5x0brETtHdzLjpu538E/F/IDPo0yBwDCudhwkplcQiWpn+i+Dozr4s4zZfU5nWRUfAumTpt1d2hq8yTduy3Whe6az1C8lB794ah6fq1klRZgLIioK+eqzLNwjlB0zrgpEOgyKhEpN9MfmXPPyUaL2dL45ccfnG9/4tbhX+U/6FNhWvvZfBZx6GUdMuq/ts= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(52116014)(5113699003)(6133799003)(18002099003)(22082099003)(56012099006)(10067099003)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?M3ZmRS9pMkZQei9BbHcrd3R4ZFBQRUhHZGN1SGRxaDJUOTgrcSt4UmhLTTl5?= =?utf-8?B?M0Q4WGcwOEloczhrcG9QNjl4UlM5VnRtUktadVFvbnIreUJZeHJQaStKazkw?= =?utf-8?B?c1BBMWNFWjIyYU90MkJleENkNHZrL2hTTTdrdlFnT3JweFNGT016R0V2NFMx?= =?utf-8?B?WGhzZ0JjOXA3ZkNUVHgzazRvRi9hdFNja2VCMUlvMEdjVE8yVkJ1OHZhMzhS?= =?utf-8?B?dGNYdkMyWXdQcHVxNmw1ZEpFTFBiQ1BkbklPUHFFNDZFeE1RNFJzek10THdP?= =?utf-8?B?YlJaWHdBY1l4NU1mRENjUURZRWhtaG9BVGpSa3VQYk5CQXcycUsxZkF5LzZh?= =?utf-8?B?dmhyNnVaaGNzZFBZQWpCTURPc0R0ZDhOTzRKdEtkQ285S3VoNVYxU28rYVN5?= =?utf-8?B?dEc2WCtBck9TMEs3VGc3N084OHVSTXQwZUpwOEhuL0ZWMXEvRmFXRFN0UldH?= =?utf-8?B?NmQ3d1NmbVU4Qk13Vi9PdDlNNm5wdmJpOXh2QkhreGJBVFBWUlBUcC9jNW1N?= =?utf-8?B?dHFVbHB3MHhEaWZRTmFMNVQyTzNxaS91THVrU21yUEdGTytoY3d6V2VzYnNT?= =?utf-8?B?Rk9SK3Y5SVVUWnkxdFBxQUhCK2tEd3lxRVJzUDk1OW5XK2xWMHh1L2ZycmUz?= =?utf-8?B?VjNJd2IxY1JaMHo2T2FWL3FNZ0hadUwrUmFJNEsveGJlMWZESk1jM1hBUUpU?= =?utf-8?B?cnVpUGNOeFFhVE9tQWM5MGpnaklRR2twUXFWZUhRb3hTRXhsVnpXZm1pa1dm?= =?utf-8?B?blA4eHcxcFlXZGx6Mm1zT251anVJc2hYbk15aDljeXFSOXc5SlM2WFJFcTR2?= =?utf-8?B?SG00S3dJK3BPVm1kS3RkMzhMM3lFWnR4UjF4SGFsRjFOUWhjUkhrVGtRTlJm?= =?utf-8?B?ckQzdUFrYTdxa0FFd1IwZFdCRmJzZm5IRCtTZkJEei9oRGs0b21hK3hTYVpq?= =?utf-8?B?T1QxU3AwRXRQZUhuNjhsTWlJZW9tSzlHUzNKZk40SzJZNG9LdFZhZnY0RGhy?= =?utf-8?B?c05uai9LQWpFQlZuWDQybFU1WDNjZmtabTFZczJNTlZ2L3NxNjM1cWUrSVdy?= =?utf-8?B?eCtPTXlvTE1BUTRMK0hVZkx4WVBndy94N2VnOE5rWGxjcy9GMDVDdFdxNXcw?= =?utf-8?B?U0ZPTURLMUlOZDJLZHdQSlB6KzRHYzdMMm5DUzZjNlErTlpBZEdNY00rMC9j?= =?utf-8?B?Sm1ad0JaNFBmcTc3Qm9HejJ0RVJpYlFHVU5Xd0ZLZFU3ZUIyaE11ZTZVTDVj?= =?utf-8?B?YTBIeXBYSjlNbnIrWG1tNGNmaXVUOFZTTFVObm1XK0FocThET2FFMEpSQnht?= =?utf-8?B?bG5KbzFuNkpkZmJCSmY5L0hWMXdQZ1pKQkFueVVjR0kwek16eEZITElEMWMr?= =?utf-8?B?Ti9VSzlVZWRYM0xiTEMrYWpJZEJwT2dGS3pnS20zamlHZmNRUWY3cHVyRWtR?= =?utf-8?B?ZDRaT1RHU0tOUHpvYktSYjRyQVFRVW1uWjBHWk1yaDI2SEMwQXVvU0s3elgr?= =?utf-8?B?YTA5d2xpNVQzM0pDMjcvY1JvdEZheGd2SXNsalJJb1Qxd2paa0owOExJeklv?= =?utf-8?B?WkhCZlNQenh0MmRGYUM1S0x5TjkxZ2hGeGNVdGo4QkYvV1gySEY2bGFmRFhm?= =?utf-8?B?SWxScnZxTEU0eGszVlVldXh5c0I1d1FDODRKQTdON1JGNHBmSlZ1UVVyNW9x?= =?utf-8?B?c1hveXlTMlBLWXZtNmZqZGQzZXkzSjFsVFhmYUVnaS85MWlseXNsQmxlazlL?= =?utf-8?B?TmtyU2VteWUyVlUrMkJOMDUwcE9sNDNMaDZNUEh2OU02MFdKMXNOUzRidnl1?= =?utf-8?B?QlE0aGpnRFZhcmVRcFJ5ZlZtL25ZS3JQejluSVlNbXl3b3poNGx3M0FWOHFq?= =?utf-8?B?Y0dXL0s2WFd4WGx0TWkySEM4a29XN0dPaUxEUmNGY0gwd3FtMnRWeXA0NE5X?= =?utf-8?B?em5LN1Yyb05YMG5BbEJOYld5N3VXcUdaUDFYNkdrRkFSdEc4TlZqZ1I4c056?= =?utf-8?B?YjhON0V5NE50WENBcklkUkhaT1R3UlZmaU1BdGw0N0hUcVpzeFlYOXowSy9B?= =?utf-8?B?NGtSV1F6QTE1L084d2lGV3FCTm1obnFDbFRTMWNiYy9hZE5PU0ZYbm9xWGxv?= =?utf-8?B?SWFocFBNb3BaSllhTmt1bHUzYndPck16MWdqemNkS0duVmVRWFJzZ2FaMGQw?= =?utf-8?B?WGtjSWN1cVNDd3Q4QWZKWVpVbERmbjdod0xiSEtxWnErV25OZUNLRkRETk0y?= =?utf-8?B?ZjQxQUlmOWk0L09YdVZlVW5DeTV0WU1zNXozRnUxVktyRElhSzhobHhmSk1H?= =?utf-8?B?QnJ2aUt5TnB1Yms4anozVkY1ZmlNUklwRWdUNnV0Vk15Mjk5cXl1ZkdFa0hi?= =?utf-8?Q?0T1ZdBw2ucKo6Go4=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0b072614-acbf-44ce-ee12-08df0a6d0063 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Sep 2026 10:12:18.5826 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: M8SVQRM8iyfAfTptBnRaAJtXM9GD69dtFSslo25RXNdCr+sWOu5DS/1ptdNf7KBmD5HRziH+HIt3hAOjvItRv/rew+gdE2s6rdaTLhUW0dw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR08MB6105 From: Daniel P. Berrangé Incorrect calculation of the boundary condition when tracking lossy rectangles in the worker thread will result in an OOB write which can corrupt further worker state, and/or trigger any guard pages that may lie beyond the VncWorker struct. This can be triggered through careful choice of the display resolution in the guest OS by an unprivileged user. Fixes: CVE-2026-48002 Reported-by: Marc-André Lureau Signed-off-by: Daniel P. Berrangé Message-ID: <20260521103353.1645561-4-berrange@redhat.com> [Marc-André - added assert() suggest by philmd@linaro.org] Signed-off-by: Marc-André Lureau (cherry picked from commit 46ee49034d26d04d95ba8f3183d4fbfa9d2b89b4) Signed-off-by: Michael Tokarev (cherry picked from commit ed1400016319f8cffb5d6ba8809a8d774976ff65) --- ui/vnc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 8ca77b2971f..7373c83b692 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -3005,13 +3005,15 @@ void vnc_sent_lossy_rect(VncWorker *worker, int x, int y, int w, int h) { int i, j; - w = (x + w) / VNC_STAT_RECT; - h = (y + h) / VNC_STAT_RECT; + w = DIV_ROUND_UP((x + w), VNC_STAT_RECT); + h = DIV_ROUND_UP((y + h), VNC_STAT_RECT); + assert(h <= VNC_STAT_ROWS); + assert(w <= VNC_STAT_COLS); x /= VNC_STAT_RECT; y /= VNC_STAT_RECT; - for (j = y; j <= h; j++) { - for (i = x; i <= w; i++) { + for (j = y; j < h; j++) { + for (i = x; i < w; i++) { worker->lossy_rect[j][i] = 1; } } -- 2.47.1