@samitouri / QOSamiQemu / commits / 7724885620

virtio-net: fix short frame OOB read in receive_filter()

Within virtio-net, receive_filter() reads Ethernet header fields without any length checks. But virtio-net sets do_not_pad in NetClientState, so backends such as socket forward frames at the size supplied by the peer without padding to the Ethernet minimum. A short frame thus causes an out-of-bounds read. Add size checks in receive_filter() and drop the truncated frames. Fixes: CVE-2026-63320 Fixes: 3831ab2094 ("qemu:virtio-net: Enable filtering based on MAC, promisc, broadcast and allmulti (Alex Williamson)") Cc: Jason Wang <jasowangio@gmail.com> Cc: Alex Williamson <alex@shazbot.org> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3626 Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <ee5c77b96ab66b2dd518f146def8727216a5c495.1784895727.git.mst@redhat.com>

Michael S. Tsirkin committed Jul 8, 2026 at 11:32 UTC 772488562053c1299fc3667a49b3ff1858f83979

1 file changed +12 -1

hw/net/virtio-net.c

+12 -1

@@ -1744,10 +1744,21 @@ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)

1744 if (n->promisc)

1745 return 1;

1746

1747 + if (size < n->host_hdr_len + 14) {

1748 + /* Truncated ethernet packet */

1749 + return 0;

1750 + }

1751 +

1752 ptr += n->host_hdr_len;

1753

1754 if (!memcmp(&ptr[12], vlan, sizeof(vlan))) {

1750 - int vid = lduw_be_p(ptr + 14) & 0xfff;

1755 + int vid;

1756 +

1757 + /* Truncated vlan packet */

1758 + if (size < n->host_hdr_len + 16) {

1759 + return 0;

1760 + }

1761 + vid = lduw_be_p(ptr + 14) & 0xfff;

1762 if (!(n->vlans[vid >> 5] & (1U << (vid & 0x1f))))

1763 return 0;

1764 }