xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-25 04:30:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
ae2158ad6c
xemu/hw/virtio
History
Michael S. Tsirkin cc45995294 virtio: out-of-bounds buffer write on invalid state load 
CVE-2013-4151 QEMU 1.0 out-of-bounds buffer write in
virtio_load@hw/virtio/virtio.c

So we have this code since way back when:

    num = qemu_get_be32(f);

    for (i = 0; i < num; i++) {
        vdev->vq[i].vring.num = qemu_get_be32(f);

array of vqs has size VIRTIO_PCI_QUEUE_MAX, so
on invalid input this will write beyond end of buffer.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05 22:15:02 +02:00
..
dataplane dataplane: fix shadowed return value 2014-01-22 13:48:18 +01:00
Makefile.objs virtio: Implement MMIO based virtio transport 2013-07-19 12:58:47 +01:00
vhost.c vhost: clear signalled_used_valid on vhost stop 2013-08-12 12:25:17 +03:00
virtio-balloon.c virtio-balloon: don't hardcode config size value 2014-01-15 23:34:17 +04:00
virtio-bus.c virtio-bus: cleanup plug/unplug interface 2013-12-09 21:46:48 +01:00
virtio-mmio.c virtio-bus: remove vdev field 2013-12-09 21:46:48 +01:00
virtio-pci.c qom: Add check() argument to object_property_add_link() 2014-03-19 22:23:13 +01:00
virtio-pci.h virtio-pci: remove vdev field 2013-12-09 21:46:48 +01:00
virtio-rng.c virtio-rng: Avoid default_backend refcount leak 2014-03-19 22:23:47 +01:00
virtio.c virtio: out-of-bounds buffer write on invalid state load 2014-05-05 22:15:02 +02:00