n 7/27/26 9:19 PM, Michael S. Tsirkin wrote:
> virtio_set_features_nocheck() calls set_features_ex
> with guest-supplied feature bits, without masking the value
> with host features (unlike set_features which gets the
> correct val & host_features).
>
> This does not matter if the driver matches spec, but drivers
> can be malicious or buggy and set bit outside the host mask.
>
> Devices don't expect this, so unsupported guest feature bits getting set
> can break the host. In virtio-net, this can enable RSC without vnet
> header support and cause out-of-bounds reads from short packets.
>
> Pass the masked features to set_features_ex, consistent with set_features.
>
> Fixes: CVE-2026-63321
> Fixes: 64a6a336f4 ("virtio: add support for negotiating extended features")
> Cc: Jason Wang <[email protected]>
> Cc: Yuri Benditovich <[email protected]>
> Cc: Paolo Abeni <[email protected]>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623
> Reported-by: huntr bubble <[email protected]>
> Signed-off-by: Michael S. Tsirkin <[email protected]>
> Message-ID:
> <dfd27c9b26e442a2076f6ddc9bb3d38363d9b2da.1784891251.git....@redhat.com>
> ---
> hw/virtio/virtio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index f4d86a3655..7c19080db5 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -3320,7 +3320,7 @@ static int virtio_set_features_nocheck(VirtIODevice
> *vdev, const uint64_t *val)
> virtio_features_and(tmp, val, vdev->host_features_ex);
>
> if (k->set_features_ex) {
> - k->set_features_ex(vdev, val);
> + k->set_features_ex(vdev, tmp);
> } else if (k->set_features) {
> bad = bad || virtio_features_use_ex(tmp);
> k->set_features(vdev, tmp[0]);
I fear this comes too late, but FWIW the fix LGTM, thanks Michael!
Acked-by: Paolo Abeni <[email protected]>
