* [Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()
@ 2015-06-17 10:46 Petr Matousek
2015-06-17 13:01 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: Petr Matousek @ 2015-06-17 10:46 UTC (permalink / raw)
To: qemu-devel; +Cc: matttait, qemu-stable, mst
Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.
Fix this by ignoring read from the Mode/Command register.
This is CVE-2015-3214.
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Reported-by: Matt Tait <matttait@google.com>
---
hw/timer/i8254.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 3450c98..9b65a33 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
PITChannelState *s;
addr &= 3;
+
+ if (addr == 3) {
+ /* Mode/Command register is write only, read is ignored */
+ return 0;
+ }
+
s = &pit->channels[addr];
if (s->status_latched) {
s->status_latched = 0;
--
2.1.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()
2015-06-17 10:46 [Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read() Petr Matousek
@ 2015-06-17 13:01 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2015-06-17 13:01 UTC (permalink / raw)
To: Petr Matousek, qemu-devel; +Cc: mst, qemu-stable, matttait
On 17/06/2015 12:46, Petr Matousek wrote:
> Due converting PIO to the new memory read/write api we no longer provide
> separate I/O region lenghts for read and write operations. As a result,
> reading from PIT Mode/Command register will end with accessing
> pit->channels with invalid index.
>
> Fix this by ignoring read from the Mode/Command register.
>
> This is CVE-2015-3214.
>
> Signed-off-by: Petr Matousek <pmatouse@redhat.com>
> Reported-by: Matt Tait <matttait@google.com>
Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
Applied, thanks.
Paolo
> ---
> hw/timer/i8254.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
> index 3450c98..9b65a33 100644
> --- a/hw/timer/i8254.c
> +++ b/hw/timer/i8254.c
> @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
> PITChannelState *s;
>
> addr &= 3;
> +
> + if (addr == 3) {
> + /* Mode/Command register is write only, read is ignored */
> + return 0;
> + }
> +
> s = &pit->channels[addr];
> if (s->status_latched) {
> s->status_latched = 0;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-06-17 13:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-17 10:46 [Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read() Petr Matousek
2015-06-17 13:01 ` Paolo Bonzini
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.