[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 06/15] i8254: fix out-of-bounds memory access in pit_
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 06/15] i8254: fix out-of-bounds memory access in pit_ioport_read() |
Date: |
Fri, 19 Jun 2015 09:45:27 +0200 |
From: Petr Matousek <address@hidden>
Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.
Fix this by ignoring read from the Mode/Command register.
This is CVE-2015-3214.
Reported-by: Matt Tait <address@hidden>
Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
Cc: address@hidden
Signed-off-by: Petr Matousek <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/timer/i8254.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 3450c98..9b65a33 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
PITChannelState *s;
addr &= 3;
+
+ if (addr == 3) {
+ /* Mode/Command register is write only, read is ignored */
+ return 0;
+ }
+
s = &pit->channels[addr];
if (s->status_latched) {
s->status_latched = 0;
--
2.4.3
- [Qemu-devel] [PULL 00/15] Timer, virtio-scsi-test, build, memory changes for 2015-06-19, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 01/15] qemu-log: Open file for logging when specified, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 03/15] qemu-ga: debug printouts to help troubleshoot installation, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 04/15] qemu-ga: Introduce Windows MSI script, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 02/15] qemu-ga: adding vss-[un]install options, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 06/15] i8254: fix out-of-bounds memory access in pit_ioport_read(),
Paolo Bonzini <=
- [Qemu-devel] [PULL 05/15] qemu-ga: Building Windows MSI installation with configure/Makefile, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 07/15] tests: Link libqos virtio object to virtio-scsi-test, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 08/15] libqos: Allow calling guest_free on NULL pointer, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 09/15] libqos: Complete virtio device ID definition list, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 10/15] tests: virtio-scsi: Move start/stop to individual test functions, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 11/15] tests: virtio-scsi: Add test for unaligned WRITE SAME, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 12/15] qemu-timer: Call clock reset notifiers on forward jumps, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 13/15] mc146818rtc: Reset the periodic timer on load, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 14/15] exec: do not clamp accesses to MMIO regions, Paolo Bonzini, 2015/06/19
- [Qemu-devel] [PULL 15/15] exec: clamp accesses against the MemoryRegionSection, Paolo Bonzini, 2015/06/19