{"action":"opened","issue":{"url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/40","labels_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/40/comments","events_url":"https://api.github.com/repos/YanVugenfirer/kvm-guest-drivers-windows/issues/40/events","html_url":"https://github.com/YanVugenfirer/kvm-guest-drivers-windows/issues/40","id":99176972,"number":40,"title":"Possible integer overflow in debug tool","user":{"login":"YanVugenfirer","id":1107032,"avatar_url":"https://avatars.githubusercontent.com/u/1107032?v=3","gravatar_id":"","url":"https://api.github.com/users/YanVugenfirer","html_url":"https://github.com/YanVugenfirer","followers_url":"https://api.github.com/users/YanVugenfirer/followers","following_url":"https://api.github.com/users/YanVugenfirer/following{/other_user}","gists_url":"https://api.github.com/users/YanVugenfirer/gists{/gist_id}","starred_url":"https://api.github.com/users/YanVugenfirer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YanVugenfirer/subscriptions","organizations_url":"https://api.github.com/users/YanVugenfirer/orgs","repos_url":"https://api.github.com/users/YanVugenfirer/repos","events_url":"https://api.github.com/users/YanVugenfirer/events{/privacy}","received_events_url":"https://api.github.com/users/YanVugenfirer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-05T10:46:32Z","updated_at":"2015-08-05T10:46:32Z","closed_at":null,"body":"Hi, We are the “Yundun Xianzhi Vulnerabilities Platform“ which is under the Aliyun of Alibaba. One of our whitehats has just reported an integer overflow vulnerability of KVM WindowsGuestDrivers of VirtIO. Here are the details about this problem provided by the whitehat.\r\n\r\n1. Version\r\n\r\nThe version is  stable_single_port_virtio-serial rhel60\r\n\r\n\r\n2. Related Source code\r\n\r\nThe function in kvm-guest-drivers-windows/NetKVM/DebugTools/VirtioConsoleSimulation/engine.c   void SetMacAddresses(int num) has integer overflow problem, the analyze are as follows:\r\n\r\n// 函数接受输入参数num\r\nEXTERN_C void SetMacAddresses(int num)\r\n{\r\n    UCHAR _mac[10] = {0};\r\n    struct virtio_net_ctrl_mac *pMacCtrl;\r\n    // 通过对num进行计算，得到mcSize值用于分配内存空间\r\n    USHORT mcSize = sizeof(uint32_t) + num * ETH_ALEN;\r\n    // 在进行malloc分配空间的时候，没有对num和mcSize进行判断，会发生整数溢出\r\n    UCHAR *multicasts = (UCHAR *)malloc(mcSize);\r\n    ....\r\n    // 后续在使用num值来访问multicasts对应的内存空间，导致访存错误！\r\n    for (i = 0; i < num; ++i)\r\n    {\r\n        UCHAR *p = &pMacCtrl->macs[i][0];\r\n \r\n\r\n3. Trigger\r\n\r\nVirtioConsoleSimulation is an independent project of VirtIO NetKVM. This vulnerability can be triggered by the following code:\r\n\r\nConsoleSim.cpp : _tmain -->\r\ntestCommands.cpp : RunScript -->\r\ntestCommands.cpp : tScriptState::Run -->\r\ntestCommands.cpp : tScriptState::ExecuteCommand  -->\r\nengine.c         : SetMacAddresses(int num)\r\n \r\nThe folloing command can trigger this:\r\n\r\nConsoleSim.exe  run.txt\r\nThe content in run.txt:\r\n\r\nprepare\r\ncontrol.mac 357913946\r\nend\r\n "}}