On 7/27/26 7:50 AM, Christian Borntraeger wrote:
Cornelia, Eric, Matt,
here are 5 more fixes for hardening QEMU against invalid input. Nothing
is strictly a security issues as defined in the policy. For example
https://qemu-project.gitlab.io/qemu/system/security.html says assert /
abort: If triggering the code path requires kernel privileges (or root
account access) in the guest, asserts/aborts in QEMU are a self
inflicted denial of service. These will not be treated as security
flaws, at most hardening bugs.
And if anyone can provide invalid boot loader content it can provide
anything to boot if secure boot is not available.
We should fix those anyway, probably even for 11.1
Conny, I did not rebuild the s390-ccw, I assume you will do that?
Christian Borntraeger (1):
hw/char/sclpconsole-lm: avoid guest triggerable assert
Joshua Daley (4):
s390x/ipl: validate num_comp against iplb length before iterating
pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()
pc-bios/s390-ccw: bounds-check zipl menu entry index before array
write
Applied these four for 11.2, with the two typos fixed as Matt mentioned,
and cc'd qemu-stable.
pc-bios/s390-ccw: bound zipl menu strlen and replace VLA in
zipl_print_entry
Will wait for a v2 on this one.
Thanks!
hw/char/sclpconsole-lm.c | 3 ++-
hw/s390x/ipl.h | 6 ++++++
pc-bios/s390-ccw/bootmap.c | 6 ++++--
pc-bios/s390-ccw/helper.h | 10 ++++++++++
pc-bios/s390-ccw/menu.c | 36 +++++++++++++++++++++++++++++-------
pc-bios/s390-ccw/s390-ccw.h | 2 +-
6 files changed, 52 insertions(+), 11 deletions(-)
