qemu-stable
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-stable] [PATCH] i8254: fix out-of-bounds memory access in pit_


From: Paolo Bonzini
Subject: Re: [Qemu-stable] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()
Date: Wed, 17 Jun 2015 15:01:38 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0


On 17/06/2015 12:46, Petr Matousek wrote:
> Due converting PIO to the new memory read/write api we no longer provide
> separate I/O region lenghts for read and write operations. As a result,
> reading from PIT Mode/Command register will end with accessing
> pit->channels with invalid index.
> 
> Fix this by ignoring read from the Mode/Command register.
> 
> This is CVE-2015-3214.
> 
> Signed-off-by: Petr Matousek <address@hidden>
> Reported-by: Matt Tait <address@hidden>

Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052

Applied, thanks.

Paolo

> ---
>  hw/timer/i8254.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
> index 3450c98..9b65a33 100644
> --- a/hw/timer/i8254.c
> +++ b/hw/timer/i8254.c
> @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr 
> addr,
>      PITChannelState *s;
>  
>      addr &= 3;
> +
> +    if (addr == 3) {
> +        /* Mode/Command register is write only, read is ignored */
> +        return 0;
> +    }
> +
>      s = &pit->channels[addr];
>      if (s->status_latched) {
>          s->status_latched = 0;
> 



reply via email to

[Prev in Thread] Current Thread [Next in Thread]