[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [Bug 786209] Re: Information leak in IDE core
From: |
T. Huth |
Subject: |
[Qemu-devel] [Bug 786209] Re: Information leak in IDE core |
Date: |
Thu, 23 Jun 2016 08:42:19 -0000 |
Fixed here:
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=40c4ed3f95f0b2ffa0848df0f
** Changed in: qemu
Status: New => Fix Released
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/786209
Title:
Information leak in IDE core
Status in QEMU:
Fix Released
Bug description:
When the DRQ_STAT bit is set, the IDE core permits both data reads and
data writes, regardless of whether the current transfer was initiated
as a read or write.
Furthermore, the IO buffer is allocated via a qemu_memalign but not
initialized or cleared at device creation.
This potentially leaks uninitialized host memory into the guest, if,
before doing anything else to an IDE device, the guest begins a write
transaction (e.g. WIN_WRITE), but then *reads* from the IO port
instead of writing to it. The IDE core will happily return the
uninitialized contents of the buffer to the guest, potentially leaking
offsets that could be used as part of an attack to get around ASLR.
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/786209/+subscriptions
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] [Bug 786209] Re: Information leak in IDE core,
T. Huth <=