@samitouri / QOSamiQemu / commits / 52c7bb369b

virtio-net: fix OOB read in RSC receive path

The RSC receive path parses incoming frames at guest_hdr_len byte offsets, but the backend buffer contains only host_hdr_len bytes of vnet header. If the lengths differ, RSC would read at the wrong offset and cause an OOB read. This is no longer possible after the previous patch, but the assumption seem fragile. Along the defense in depth lines, let's validate. To ensure we are not breaking any valid setups by mistake, warn and fall back to the normal receive path when host_hdr_len != guest_hdr_len. Fixes: CVE-2026-63321 Fixes: 2974e916df ("virtio-net: support RSC v4/v6 tcp traffic for Windows HCK") Cc: Jason Wang <jasowangio@gmail.com> Cc: Yuri Benditovich <ybendito@redhat.com> Cc: Wei Xu <wexu@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623 Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <f261dcd535edc890f8636d8ae5ac1007bc32b8b4.1784891251.git.mst@redhat.com>

Michael S. Tsirkin committed Jul 15, 2026 at 12:33 UTC 52c7bb369b23dfcafb6e6d90665c777797b55e88
1 file changed +7
hw/net/virtio-net.c
+7
@@ -2674,6 +2674,13 @@ static ssize_t virtio_net_receive(NetClientState *nc, const uint8_t *buf,
2674 {
2675 VirtIONet *n = qemu_get_nic_opaque(nc);
2676 if ((n->rsc4_enabled || n->rsc6_enabled)) {
2677 + /* this never happens with existing backends, but just in case. */
2678 + if (n->host_hdr_len != n->guest_hdr_len) {
2679 + warn_report_once("virtio-net: host_hdr_len %zu != guest_hdr_len %zu, "
2680 + "skipping RSC",
2681 + n->host_hdr_len, n->guest_hdr_len);
2682 + return virtio_net_do_receive(nc, buf, size);
2683 + }
2684 return virtio_net_rsc_receive(nc, buf, size);
2685 } else {
2686 return virtio_net_do_receive(nc, buf, size);