QEMU 虚拟机逃逸漏洞（CVE-2019-14378）漏洞分析

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version|  IHL  |Type of Service|          Total Length         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|         Identification        |Flags|      Fragment Offset    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Time to Live |    Protocol   |         Header Checksum       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Source Address                          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Destination Address                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Options                    |    Padding    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Bit 0: 保留为, 必须为0
Bit 1: (DF) 0 = 分片, 1 = 不分片.
Bit 2: (MF) 0 =最后一个ip包, 1 = 后面还有分片
Fragment Offset: 13 bits

struct mbuf {
    /* header at beginning of each mbuf: */
    struct mbuf *m_next; /* Linked list of mbufs */
    struct mbuf *m_prev;
    struct mbuf *m_nextpkt; /* Next packet in queue/record */
    struct mbuf *m_prevpkt; /* Flags aren't used in the output queue */
    int m_flags; /* Misc flags */

    int m_size; /* Size of mbuf, from m_dat or m_ext */
    struct socket *m_so;

    char *m_data; /* Current location of data */
    int m_len; /* Amount of data in this mbuf, from m_data */

    ...

    char *m_ext;
    /* start of dynamic buffer area, must be last element */
    char m_dat[];
};

/*
 * Take incoming datagram fragment and try to
 * reassemble it into whole datagram.  If a chain for
 * reassembly of this datagram already exists, then it
 * is given as fp; otherwise have to make a chain.
 */
static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
{

    ...
    ...

    /*
     * Reassembly is complete; concatenate fragments.
     */
    q = fp->frag_link.next;
    m = dtom(slirp, q);

    q = (struct ipasfrag *)q->ipf_next;
    while (q != (struct ipasfrag *)&fp->frag_link) {
        struct mbuf *t = dtom(slirp, q);
        q = (struct ipasfrag *)q->ipf_next;
        m_cat(m, t);
    }

    /*
     * Create header for new ip packet by
     * modifying header of first packet;
     * dequeue and discard fragment reassembly header.
     * Make header visible.
     */
    q = fp->frag_link.next;

    /*
     * If the fragments concatenated to an mbuf that's
     * bigger than the total size of the fragment, then and
     * m_ext buffer was alloced. But fp->ipq_next points to
     * the old buffer (in the mbuf), so we must point ip
     * into the new buffer.
     */
    if (m->m_flags & M_EXT) {
        int delta = (char *)q - m->m_dat;
        q = (struct ipasfrag *)(m->m_ext + delta);
    }

/*
 * Ip header, when holding a fragment.
 *
 * Note: ipf_link must be at same offset as frag_link above
 */
struct ipasfrag {
    struct qlink ipf_link;
    struct ip ipf_ip;
};

struct qlink {
    void *next, *prev;
};

gdb-peda$ p *q
$30 = {
  ipf_link = {
    next = 0x7f9e08084ed0,
    prev = 0x7f9e0808487c
  },
  ipf_ip = {
    ip_hl = 0x5,
    ip_v = 0x4,
    ip_tos = 0x0,
    ip_len = 0x8,
    ip_id = 0x7f3a,
    ip_off = 0x8,
    ip_ttl = 0x40,
    ip_p = 0x1,
    ip_sum = 0x95e3,
    ip_src = {
      s_addr = 0xf02000a
    },
    ip_dst = {
      s_addr = 0x202000a
    }
  }
}

gdb-peda$ p q
$41 = (struct ipasfrag *) 0x7f9e0808882c
gdb-peda$ p *m
$42 = {
  m_next = 0x7f9e080881a0,
  m_prev = 0x7f9e080874c0,
  m_nextpkt = 0x0,
  m_prevpkt = 0x0,
  m_flags = 0xd,
  m_size = 0xcde,
  m_so = 0x0,
  m_data = 0x7f9e08088850 "",
  m_len = 0xc98,
  slirp = 0x563aa67a6380,
  resolution_requested = 0x0,
  expiration_date = 0xffffffffffffffff,
  m_ext = 0x7f9e08088810 "",
  m_dat = 0x7f9e08086eb0 ""
}
gdb-peda$ p *q
$43 = {
  ipf_link = {
    next = 0x7f9e0808487c,
    prev = 0x7f9e08087520
  },
  ipf_ip = {
    ip_hl = 0x5,
    ip_v = 0x4,
    ip_tos = 0x1,
    ip_len = 0xc90,
    ip_id = 0x7f3e,
    ip_off = 0x0,
    ip_ttl = 0x40,
    ip_p = 0x1,
    ip_sum = 0x1c43,
    ip_src = {
      s_addr = 0xffffff8b
    },
    ip_dst = {
      s_addr = 0x0
    }
  }
}

+------------------------------+
|                              |
|                              |
|                              |
|                              |
| m_dat 0x7f9e08086eb0         |
|                              |
|                              |
+------------------------------+
|                              |
|m->m_ext 0x7f9e08088810       |
|                              |
|                              |
|q 0x7f9e0808882c              |
|                              |
|                              |
|                              |
+------------------------------+

slirp/src/ip_input.c:ip_reass
    ip = fragtoip(q);   //转换
    ip->ip_len = next;
    ip->ip_tos &= ~1;
    ip->ip_src = fp->ipq_src;
    ip->ip_dst = fp->ipq_dst;