From a27fa3a882923792e947917bf5d47c16aaecd6d4 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 21 Jul 2026 06:02:07 -0400 Subject: [PATCH] import Oracle_OSS qemu-kvm-10.1.0-17.el9_8.4 --- ...issing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch | 61 +++++++++++++++++++ SPECS/qemu-kvm.spec | 9 ++- 2 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 SOURCES/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch diff --git a/SOURCES/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch b/SOURCES/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch new file mode 100644 index 0000000..91a985d --- /dev/null +++ b/SOURCES/kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch @@ -0,0 +1,61 @@ +From 085815fbd5c6b291865122639a8247b19c872adb Mon Sep 17 00:00:00 2001 +From: Stefan Hajnoczi +Date: Tue, 26 May 2026 11:49:57 -0400 +Subject: [PATCH] virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check + (CVE-2026-48914) + +RH-Author: Stefan Hajnoczi +RH-MergeRequest: 561: virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) +RH-Jira: RHEL-184527 +RH-Acked-by: Kevin Wolf +RH-Acked-by: Jon Maloy +RH-Commit: [1/1] 083076b14c0d3b83095d2202e114d8af3052d038 + +Check that the iovec containing struct virtio_scsi_inhdr is large enough +before storing an error value there. + +Feifan Qian pointed out that this can be used to +corrupt heap memory when the descriptor uses an MMIO address and a +length of 1, forcing QEMU to allocate a 1-byte heap bounce buffer. +virtio_stl_p() stores 4 bytes and therefore corrupts whatever is beyond +the bounce buffer. + +Fixes: CVE-2026-48914 +Fixes: f34e73cd69bd ("virtio-blk: report non-zero status when failing SG_IO requests") +Reported-by: Feifan Qian +Cc: Paolo Bonzini +Signed-off-by: Stefan Hajnoczi +Message-ID: <20260526154957.1741622-1-stefanha@redhat.com> +Reviewed-by: Kevin Wolf +Signed-off-by: Kevin Wolf +(cherry picked from commit aeea0c2804c42f24915467a1e4c70e649e39b8e0) +Signed-off-by: Stefan Hajnoczi +--- + hw/block/virtio-blk.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c +index 9bab2716c1..a0678300b4 100644 +--- a/hw/block/virtio-blk.c ++++ b/hw/block/virtio-blk.c +@@ -200,10 +200,16 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req) + + /* + * The scsi inhdr is placed in the second-to-last input segment, just +- * before the regular inhdr. ++ * before the regular inhdr. VIRTIO implementations normally do not rely on ++ * the precise message framing, but legacy implementations did and so we do ++ * too for the legacy virtio-blk SCSI request type. + * + * Just put anything nonzero so that the ioctl fails in the guest. + */ ++ if (elem->in_sg[elem->in_num - 2].iov_len != sizeof(*scsi)) { ++ status = VIRTIO_BLK_S_IOERR; ++ goto fail; ++ } + scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base; + virtio_stl_p(vdev, &scsi->errors, 255); + status = VIRTIO_BLK_S_UNSUPP; +-- +2.52.0 + diff --git a/SPECS/qemu-kvm.spec b/SPECS/qemu-kvm.spec index 0c1e389..1b13b4c 100644 --- a/SPECS/qemu-kvm.spec +++ b/SPECS/qemu-kvm.spec @@ -149,7 +149,7 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version} \ Summary: QEMU is a machine emulator and virtualizer Name: qemu-kvm Version: 10.1.0 -Release: 17%{?rcrel}%{?dist}%{?cc_suffix}.3 +Release: 17%{?rcrel}%{?dist}%{?cc_suffix}.4 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped # Epoch 15 used for RHEL 8 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5) @@ -357,6 +357,8 @@ Patch105: kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch Patch106: kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch # For RHEL-184951 - MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z] Patch107: kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch +# For RHEL-184527 - CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z] +Patch108: kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch # For RHEL-11424 - [IBM 9.6 FEAT] KVM: Full boot order support - qemu part @@ -2071,6 +2073,11 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %endif %changelog +* Mon Jun 22 2026 Jon Maloy - 10.1.0-17.el9_8.4 +- kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] +- Resolves: RHEL-184527 + (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) + * Wed Jun 17 2026 Jon Maloy - 10.1.0-17.el9_8.3 - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951]