From 4331ed2b6cd968adbc3490ca941ac04b58a0c41c Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 11 Mar 2026 20:12:26 +0000 Subject: [PATCH] Patch qemu for CVE-2025-14876, CVE-2024-8354 --- SPECS/qemu/CVE-2024-8354.patch | 74 +++++++++++++++++++++++++++++++++ SPECS/qemu/CVE-2025-14876.patch | 50 ++++++++++++++++++++++ SPECS/qemu/qemu.spec | 7 +++- 3 files changed, 130 insertions(+), 1 deletion(-) create mode 100644 SPECS/qemu/CVE-2024-8354.patch create mode 100644 SPECS/qemu/CVE-2025-14876.patch diff --git a/SPECS/qemu/CVE-2024-8354.patch b/SPECS/qemu/CVE-2024-8354.patch new file mode 100644 index 00000000000..f9461b93ad6 --- /dev/null +++ b/SPECS/qemu/CVE-2024-8354.patch @@ -0,0 +1,74 @@ +From 3f96bd7f8f0e77baa3d0d8cf8847e35ce1f2a646 Mon Sep 17 00:00:00 2001 +From: Peter Maydell +Date: Mon, 15 Sep 2025 14:29:10 +0100 +Subject: [PATCH] hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint + +If the guest feeds invalid data to the UHCI controller, we +can assert: +qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed. + +(see issue 2548 for the repro case). This happens because the guest +attempts USB_TOKEN_SETUP to an endpoint other than 0, which is not +valid. The controller code doesn't catch this guest error, so +instead we hit the assertion in the USB core code. + +Catch the case of SETUP to non-zero endpoint, and treat it as a fatal +error in the TD, in the same way we do for an invalid PID value in +the TD. + +This is the UHCI equivalent of the same bug in OHCI that we fixed in +commit 3c3c233677 ("hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or +OUT"). + +This bug has been tracked as CVE-2024-8354. + +Cc: qemu-stable@nongnu.org +Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2548 +Signed-off-by: Peter Maydell +Reviewed-by: Michael Tokarev +Signed-off-by: rpm-build +Upstream-reference: https://github.com/qemu/qemu/commit/d0af3cd0274e265435170a583c72b9f0a4100dff.patch +--- + hw/usb/hcd-uhci.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c +index a03cf22..42d34f0 100644 +--- a/hw/usb/hcd-uhci.c ++++ b/hw/usb/hcd-uhci.c +@@ -724,6 +724,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr, + bool spd; + bool queuing = (q != NULL); + uint8_t pid = td->token & 0xff; ++ uint8_t ep_id = (td->token >> 15) & 0xf; + UHCIAsync *async; + + async = uhci_async_find_td(s, td_addr); +@@ -767,9 +768,14 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr, + + switch (pid) { + case USB_TOKEN_OUT: +- case USB_TOKEN_SETUP: + case USB_TOKEN_IN: + break; ++ case USB_TOKEN_SETUP: ++ /* SETUP is only valid to endpoint 0 */ ++ if (ep_id == 0) { ++ break; ++ } ++ /* fallthrough */ + default: + /* invalid pid : frame interrupted */ + s->status |= UHCI_STS_HCPERR; +@@ -816,7 +822,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr, + return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV, + int_mask); + } +- ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf); ++ ep = usb_ep_get(dev, pid, ep_id); + q = uhci_queue_new(s, qh_addr, td, ep); + } + async = uhci_async_alloc(q, td_addr); +-- +2.45.4 + diff --git a/SPECS/qemu/CVE-2025-14876.patch b/SPECS/qemu/CVE-2025-14876.patch new file mode 100644 index 00000000000..213fff7796e --- /dev/null +++ b/SPECS/qemu/CVE-2025-14876.patch @@ -0,0 +1,50 @@ +From 7f06bba748f806932804cf7617b566cfcefe849f Mon Sep 17 00:00:00 2001 +From: zhenwei pi +Date: Sun, 21 Dec 2025 10:43:20 +0800 +Subject: [PATCH] hw/virtio/virtio-crypto: verify asym request size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The total lenght of request is limited by cryptodev config, verify it +to avoid unexpected request from guest. + +Fixes: CVE-2025-14876 +Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm") +Reported-by: 이재영 +Signed-off-by: zhenwei pi +Reviewed-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Message-Id: <20251221024321.143196-2-zhenwei.pi@linux.dev> +Signed-off-by: rpm-build +Upstream-reference: https://github.com/qemu/qemu/commit/91c6438caffc880e999a7312825479685d659b44.patch +--- + hw/virtio/virtio-crypto.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c +index 5034768..5e5c9cd 100644 +--- a/hw/virtio/virtio-crypto.c ++++ b/hw/virtio/virtio-crypto.c +@@ -767,11 +767,18 @@ virtio_crypto_handle_asym_req(VirtIOCrypto *vcrypto, + uint32_t len; + uint8_t *src = NULL; + uint8_t *dst = NULL; ++ uint64_t max_len; + + asym_op_info = g_new0(CryptoDevBackendAsymOpInfo, 1); + src_len = ldl_le_p(&req->para.src_data_len); + dst_len = ldl_le_p(&req->para.dst_data_len); + ++ max_len = (uint64_t)src_len + dst_len; ++ if (unlikely(max_len > vcrypto->conf.max_size)) { ++ virtio_error(vdev, "virtio-crypto asym request is too large"); ++ goto err; ++ } ++ + if (src_len > 0) { + src = g_malloc0(src_len); + len = iov_to_buf(iov, out_num, 0, src, src_len); +-- +2.45.4 + diff --git a/SPECS/qemu/qemu.spec b/SPECS/qemu/qemu.spec index 33e44083763..e92a09ec922 100644 --- a/SPECS/qemu/qemu.spec +++ b/SPECS/qemu/qemu.spec @@ -435,7 +435,7 @@ Obsoletes: sgabios-bin <= 1:0.20180715git-10.fc38 Summary: QEMU is a FAST! processor emulator Name: qemu Version: 9.1.0 -Release: 1%{?dist} +Release: 2%{?dist} License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND FSFAP AND GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-2.0-or-later WITH GCC-exception-2.0 AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND MIT AND LicenseRef-Fedora-Public-Domain AND CC-BY-3.0 URL: http://www.qemu.org/ @@ -448,6 +448,8 @@ Patch2: 0002-Disable-failing-tests-on-azl.patch Patch3: CVE-2021-20255.patch Patch4: CVE-2025-11234.patch Patch5: CVE-2025-12464.patch +Patch6: CVE-2024-8354.patch +Patch7: CVE-2025-14876.patch Source10: qemu-guest-agent.service Source11: 99-qemu-guest-agent.rules @@ -3407,6 +3409,9 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \ %changelog +* Wed Mar 11 2026 Azure Linux Security Servicing Account - 9.1.0-2 +- Patch for CVE-2025-14876, CVE-2024-8354 + * Fri Feb 06 2026 Aadhar Agarwal - 9.1.0-1 - Upgrade to QEMU 9.1.0 - Remove CVE patches merged upstream: CVE-2023-6683, CVE-2023-6693,