|
 |
05bba0 |
From 5ba6a1889f6da826b7a3b16381977806d8efe553 Mon Sep 17 00:00:00 2001
|
|
|
a13b82 |
From: Petr Matousek <pmatouse@redhat.com>
|
|
|
a13b82 |
Date: Thu, 25 Jun 2015 12:46:37 +0200
|
|
|
05bba0 |
Subject: [PATCH 01/10] i8254: fix out-of-bounds memory access in
|
|
|
05bba0 |
pit_ioport_read()
|
|
|
a13b82 |
|
|
|
a13b82 |
Message-id: <20150625124637.GJ18896@dhcp-25-225.brq.redhat.com>
|
|
|
a13b82 |
Patchwork-id: 66478
|
|
|
a13b82 |
O-Subject: [RHEL-7.2 qemu-kvm PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()
|
|
|
a13b82 |
Bugzilla: 1229646
|
|
|
a13b82 |
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
|
|
|
a13b82 |
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
|
a13b82 |
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
a13b82 |
|
|
|
a13b82 |
Upstream: d4862a87e31a51de9eb260f25c9e99a75efe3235
|
|
|
a13b82 |
|
|
|
a13b82 |
Due converting PIO to the new memory read/write api we no longer provide
|
|
|
a13b82 |
separate I/O region lenghts for read and write operations. As a result,
|
|
|
a13b82 |
reading from PIT Mode/Command register will end with accessing
|
|
|
a13b82 |
pit->channels with invalid index.
|
|
|
a13b82 |
|
|
|
a13b82 |
Fix this by ignoring read from the Mode/Command register.
|
|
|
a13b82 |
|
|
|
a13b82 |
This is CVE-2015-3214.
|
|
|
a13b82 |
|
|
|
a13b82 |
Reported-by: Matt Tait <matttait@google.com>
|
|
|
a13b82 |
Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
|
|
|
a13b82 |
Cc: qemu-stable@nongnu.org
|
|
|
a13b82 |
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
|
|
|
a13b82 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
a13b82 |
|
|
|
a13b82 |
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
|
|
|
a13b82 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
a13b82 |
---
|
|
|
a13b82 |
hw/timer/i8254.c | 6 ++++++
|
|
|
a13b82 |
1 file changed, 6 insertions(+)
|
|
|
a13b82 |
|
|
|
a13b82 |
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
|
|
|
a13b82 |
index 20c0c36..64c9f58 100644
|
|
|
a13b82 |
--- a/hw/timer/i8254.c
|
|
|
a13b82 |
+++ b/hw/timer/i8254.c
|
|
|
a13b82 |
@@ -187,6 +187,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
|
|
|
a13b82 |
PITChannelState *s;
|
|
|
a13b82 |
|
|
|
a13b82 |
addr &= 3;
|
|
|
a13b82 |
+
|
|
|
a13b82 |
+ if (addr == 3) {
|
|
|
a13b82 |
+ /* Mode/Command register is write only, read is ignored */
|
|
|
a13b82 |
+ return 0;
|
|
|
a13b82 |
+ }
|
|
|
a13b82 |
+
|
|
|
a13b82 |
s = &pit->channels[addr];
|
|
|
a13b82 |
if (s->status_latched) {
|
|
|
a13b82 |
s->status_latched = 0;
|
|
|
a13b82 |
--
|
|
|
a13b82 |
1.8.3.1
|
|
|
a13b82 |
|