[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] 0be839: migration: fix parameter validation o
From: |
GitHub |
Subject: |
[Qemu-commits] [qemu/qemu] 0be839: migration: fix parameter validation on ram load |
Date: |
Tue, 18 Nov 2014 06:00:08 -0800 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: 0be839a2701369f669532ea5884c15bead1c6e08
https://github.com/qemu/qemu/commit/0be839a2701369f669532ea5884c15bead1c6e08
Author: Michael S. Tsirkin <address@hidden>
Date: 2014-11-18 (Tue, 18 Nov 2014)
Changed paths:
M arch_init.c
Log Message:
-----------
migration: fix parameter validation on ram load
During migration, the values read from migration stream during ram load
are not validated. Especially offset in host_from_stream_offset() and
also the length of the writes in the callers of said function.
To fix this, we need to make sure that the [offset, offset + length]
range fits into one of the allocated memory regions.
Validating addr < len should be sufficient since data seems to always be
managed in TARGET_PAGE_SIZE chunks.
Fixes: CVE-2014-7840
Note: follow-up patches add extra checks on each block->host access.
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
Signed-off-by: Amit Shah <address@hidden>
Commit: ea5b201a0acfb4c3029afd4e7999b4278e1351d4
https://github.com/qemu/qemu/commit/ea5b201a0acfb4c3029afd4e7999b4278e1351d4
Author: Peter Maydell <address@hidden>
Date: 2014-11-18 (Tue, 18 Nov 2014)
Changed paths:
M arch_init.c
Log Message:
-----------
Merge remote-tracking branch 'remotes/amit-migration/tags/for-2.2' into
staging
Fix for CVE-2014-7840, avoiding arbitrary qemu memory overwrite for
migration by Michael S. Tsirkin.
# gpg: Signature made Tue 18 Nov 2014 11:23:00 GMT using RSA key ID 854083B6
# gpg: Good signature from "Amit Shah <address@hidden>"
# gpg: aka "Amit Shah <address@hidden>"
# gpg: aka "Amit Shah <address@hidden>"
* remotes/amit-migration/tags/for-2.2:
migration: fix parameter validation on ram load
Signed-off-by: Peter Maydell <address@hidden>
Compare: https://github.com/qemu/qemu/compare/444b1996cb37...ea5b201a0acf
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] 0be839: migration: fix parameter validation on ram load,
GitHub <=