[AutoPR- Security] Patch qemu for CVE-2025-14876, CVE-2024-8354 [MEDIUM]#16173
Open
azurelinux-security wants to merge 1 commit intomicrosoft:3.0-devfrom
Open
[AutoPR- Security] Patch qemu for CVE-2025-14876, CVE-2024-8354 [MEDIUM]#16173azurelinux-security wants to merge 1 commit intomicrosoft:3.0-devfrom
azurelinux-security wants to merge 1 commit intomicrosoft:3.0-devfrom
Conversation
microsoft-github-policy-service
bot
added
Packaging
3.0-dev
Contributor
Author
🔒 CVE Patch Review: CVE-2024-8354, CVE-2025-14876PR #16173 — [AutoPR- Security] Patch qemu for CVE-2025-14876, CVE-2024-8354 [MEDIUM] Spec File Validation
Build Verification
🤖 AI Build Log Analysis
🧪 Test Log Analysis
🤖 AI Test Log Analysis
Patch Analysis
Detailed analysisComparison of hunks:
Context/offsets: The PR patch applies the hunks at slightly different line numbers (724/767/816 vs 735/778/829), and with different blob indices, which is expected for a backport to a different QEMU base. The surrounding context in the PR matches the upstream locations and semantics (same function, same control flow around error handling). No upstream hunks are missing. Metadata differences: The PR patch includes additional Signed-off-by and an Upstream-reference URL appropriate for packaging; these do not affect code. Risk assessment: Low. The PR implements the same minimal and targeted change as upstream. It only affects handling of invalid guest input (SETUP to non-zero endpoint), converting a crash/assertion into a handled controller error. Potential regressions are unlikely, as valid SETUP to endpoint 0 remains permitted and other paths are unchanged.
Raw diff (upstream vs PR)--- upstream
+++ pr
@@ -1,69 +1,80 @@
-From d0af3cd0274e265435170a583c72b9f0a4100dff Mon Sep 17 00:00:00 2001
-From: Peter Maydell <peter.maydell@linaro.org>
-Date: Mon, 15 Sep 2025 14:29:10 +0100
-Subject: [PATCH] hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint
-
-If the guest feeds invalid data to the UHCI controller, we
-can assert:
-qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
-
-(see issue 2548 for the repro case). This happens because the guest
-attempts USB_TOKEN_SETUP to an endpoint other than 0, which is not
-valid. The controller code doesn't catch this guest error, so
-instead we hit the assertion in the USB core code.
-
-Catch the case of SETUP to non-zero endpoint, and treat it as a fatal
-error in the TD, in the same way we do for an invalid PID value in
-the TD.
-
-This is the UHCI equivalent of the same bug in OHCI that we fixed in
-commit 3c3c233677 ("hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or
-OUT").
-
-This bug has been tracked as CVE-2024-8354.
-
-Cc: qemu-stable@nongnu.org
-Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2548
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
----
- hw/usb/hcd-uhci.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
-index 4822c704f6922..e207d0587a117 100644
---- a/hw/usb/hcd-uhci.c
-+++ b/hw/usb/hcd-uhci.c
-@@ -735,6 +735,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
- bool spd;
- bool queuing = (q != NULL);
- uint8_t pid = td->token & 0xff;
-+ uint8_t ep_id = (td->token >> 15) & 0xf;
- UHCIAsync *async;
-
- async = uhci_async_find_td(s, td_addr);
-@@ -778,9 +779,14 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
-
- switch (pid) {
- case USB_TOKEN_OUT:
-- case USB_TOKEN_SETUP:
- case USB_TOKEN_IN:
- break;
-+ case USB_TOKEN_SETUP:
-+ /* SETUP is only valid to endpoint 0 */
-+ if (ep_id == 0) {
-+ break;
-+ }
-+ /* fallthrough */
- default:
- /* invalid pid : frame interrupted */
- s->status |= UHCI_STS_HCPERR;
-@@ -829,7 +835,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
- return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
- int_mask);
- }
-- ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
-+ ep = usb_ep_get(dev, pid, ep_id);
- q = uhci_queue_new(s, qh_addr, td, ep);
- }
- async = uhci_async_alloc(q, td_addr);
+diff --git a/SPECS/qemu/CVE-2024-8354.patch b/SPECS/qemu/CVE-2024-8354.patch
+new file mode 100644
+index 00000000000..f9461b93ad6
+--- /dev/null
++++ b/SPECS/qemu/CVE-2024-8354.patch
+@@ -0,0 +1,74 @@
++From 3f96bd7f8f0e77baa3d0d8cf8847e35ce1f2a646 Mon Sep 17 00:00:00 2001
++From: Peter Maydell <peter.maydell@linaro.org>
++Date: Mon, 15 Sep 2025 14:29:10 +0100
++Subject: [PATCH] hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint
++
++If the guest feeds invalid data to the UHCI controller, we
++can assert:
++qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.
++
++(see issue 2548 for the repro case). This happens because the guest
++attempts USB_TOKEN_SETUP to an endpoint other than 0, which is not
++valid. The controller code doesn't catch this guest error, so
++instead we hit the assertion in the USB core code.
++
++Catch the case of SETUP to non-zero endpoint, and treat it as a fatal
++error in the TD, in the same way we do for an invalid PID value in
++the TD.
++
++This is the UHCI equivalent of the same bug in OHCI that we fixed in
++commit 3c3c233677 ("hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or
++OUT").
++
++This bug has been tracked as CVE-2024-8354.
++
++Cc: qemu-stable@nongnu.org
++Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2548
++Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
++Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
++Signed-off-by: rpm-build <rpm-build>
++Upstream-reference: https://github.com/qemu/qemu/commit/d0af3cd0274e265435170a583c72b9f0a4100dff.patch
++---
++ hw/usb/hcd-uhci.c | 10 ++++++++--
++ 1 file changed, 8 insertions(+), 2 deletions(-)
++
++diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
++index a03cf22..42d34f0 100644
++--- a/hw/usb/hcd-uhci.c
+++++ b/hw/usb/hcd-uhci.c
++@@ -724,6 +724,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
++ bool spd;
++ bool queuing = (q != NULL);
++ uint8_t pid = td->token & 0xff;
+++ uint8_t ep_id = (td->token >> 15) & 0xf;
++ UHCIAsync *async;
++
++ async = uhci_async_find_td(s, td_addr);
++@@ -767,9 +768,14 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
++
++ switch (pid) {
++ case USB_TOKEN_OUT:
++- case USB_TOKEN_SETUP:
++ case USB_TOKEN_IN:
++ break;
+++ case USB_TOKEN_SETUP:
+++ /* SETUP is only valid to endpoint 0 */
+++ if (ep_id == 0) {
+++ break;
+++ }
+++ /* fallthrough */
++ default:
++ /* invalid pid : frame interrupted */
++ s->status |= UHCI_STS_HCPERR;
++@@ -816,7 +822,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
++ return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
++ int_mask);
++ }
++- ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
+++ ep = usb_ep_get(dev, pid, ep_id);
++ q = uhci_queue_new(s, qh_addr, td, ep);
++ }
++ async = uhci_async_alloc(q, td_addr);
++--
++2.45.4
++
--- upstream
+++ pr
@@ -1,45 +1,56 @@
-From 91c6438caffc880e999a7312825479685d659b44 Mon Sep 17 00:00:00 2001
-From: zhenwei pi <pizhenwei@tensorfer.com>
-Date: Sun, 21 Dec 2025 10:43:20 +0800
-Subject: [PATCH] hw/virtio/virtio-crypto: verify asym request size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The total lenght of request is limited by cryptodev config, verify it
-to avoid unexpected request from guest.
-
-Fixes: CVE-2025-14876
-Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm")
-Reported-by: 이재영 <nakamurajames123@gmail.com>
-Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Message-Id: <20251221024321.143196-2-zhenwei.pi@linux.dev>
----
- hw/virtio/virtio-crypto.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
-index cbd1810fbc6fa..6fceb396813d2 100644
---- a/hw/virtio/virtio-crypto.c
-+++ b/hw/virtio/virtio-crypto.c
-@@ -767,11 +767,18 @@ virtio_crypto_handle_asym_req(VirtIOCrypto *vcrypto,
- uint32_t len;
- uint8_t *src = NULL;
- uint8_t *dst = NULL;
-+ uint64_t max_len;
-
- asym_op_info = g_new0(CryptoDevBackendAsymOpInfo, 1);
- src_len = ldl_le_p(&req->para.src_data_len);
- dst_len = ldl_le_p(&req->para.dst_data_len);
-
-+ max_len = (uint64_t)src_len + dst_len;
-+ if (unlikely(max_len > vcrypto->conf.max_size)) {
-+ virtio_error(vdev, "virtio-crypto asym request is too large");
-+ goto err;
-+ }
+diff --git a/SPECS/qemu/CVE-2025-14876.patch b/SPECS/qemu/CVE-2025-14876.patch
+new file mode 100644
+index 00000000000..213fff7796e
+--- /dev/null
++++ b/SPECS/qemu/CVE-2025-14876.patch
+@@ -0,0 +1,50 @@
++From 7f06bba748f806932804cf7617b566cfcefe849f Mon Sep 17 00:00:00 2001
++From: zhenwei pi <pizhenwei@tensorfer.com>
++Date: Sun, 21 Dec 2025 10:43:20 +0800
++Subject: [PATCH] hw/virtio/virtio-crypto: verify asym request size
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
+
- if (src_len > 0) {
- src = g_malloc0(src_len);
- len = iov_to_buf(iov, out_num, 0, src, src_len);
++The total lenght of request is limited by cryptodev config, verify it
++to avoid unexpected request from guest.
++
++Fixes: CVE-2025-14876
++Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm")
++Reported-by: 이재영 <nakamurajames123@gmail.com>
++Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev>
++Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
++Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
++Message-Id: <20251221024321.143196-2-zhenwei.pi@linux.dev>
++Signed-off-by: rpm-build <rpm-build>
++Upstream-reference: https://github.com/qemu/qemu/commit/91c6438caffc880e999a7312825479685d659b44.patch
++---
++ hw/virtio/virtio-crypto.c | 7 +++++++
++ 1 file changed, 7 insertions(+)
++
++diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
++index 5034768..5e5c9cd 100644
++--- a/hw/virtio/virtio-crypto.c
+++++ b/hw/virtio/virtio-crypto.c
++@@ -767,11 +767,18 @@ virtio_crypto_handle_asym_req(VirtIOCrypto *vcrypto,
++ uint32_t len;
++ uint8_t *src = NULL;
++ uint8_t *dst = NULL;
+++ uint64_t max_len;
++
++ asym_op_info = g_new0(CryptoDevBackendAsymOpInfo, 1);
++ src_len = ldl_le_p(&req->para.src_data_len);
++ dst_len = ldl_le_p(&req->para.dst_data_len);
++
+++ max_len = (uint64_t)src_len + dst_len;
+++ if (unlikely(max_len > vcrypto->conf.max_size)) {
+++ virtio_error(vdev, "virtio-crypto asym request is too large");
+++ goto err;
+++ }
+++
++ if (src_len > 0) {
++ src = g_malloc0(src_len);
++ len = iov_to_buf(iov, out_num, 0, src, src_len);
++--
++2.45.4
++
Verdict❌ CHANGES REQUESTED — Please address the issues flagged above. |
Kanishk-Bansal
approved these changes
Mar 12, 2026
Contributor
Kanishk-Bansal
left a comment
Kanishk-Bansal
left a comment
There was a problem hiding this comment.
Patch matches upstream, we are removing the test using 0002-Disable-failing-tests-on-azl.patch
AI analysis for build warnings are known and harmless.
LGTM
Kanishk-Bansal
added
the
ready-for-stable-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto Patch qemu for CVE-2025-14876, CVE-2024-8354.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1067687&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology