rutabaga_cmd_get_capset_info() only fills in capset_id, capset_max_version and capset_max_size before sending the response to the guest. The remaining fields of struct virtio_gpu_resp_capset_info, including hdr.fence_id, hdr.ctx_id and hdr.ring_idx, are left with stack garbage and leaked to the guest, including host pointers useful for an ASLR bypass.
Zero the response first, matching virgl_cmd_get_capset_info(). Not a real risk thanks to -ftrivial-auto-var-init=zero, but only with gcc >= 12 or clang >= 16. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3609 Fixes: 1dcc6adbc168 ("gfxstream + rutabaga: add initial support for gfxstream") Reported-by: Haotian Jiang <[email protected]> Reviewed-by: Akihiko Odaki <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- hw/display/virtio-gpu-rutabaga.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c index 8e6c7a0d5ddc..e28aad94eead 100644 --- a/hw/display/virtio-gpu-rutabaga.c +++ b/hw/display/virtio-gpu-rutabaga.c @@ -556,6 +556,8 @@ rutabaga_cmd_get_capset_info(VirtIOGPU *g, struct virtio_gpu_ctrl_command *cmd) VIRTIO_GPU_FILL_CMD(info); + memset(&resp, 0, sizeof(resp)); + result = rutabaga_get_capset_info(vr->rutabaga, info.capset_index, &resp.capset_id, &resp.capset_max_version, &resp.capset_max_size); -- 2.55.0
