[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] edc243: virtio-net: fix guest-triggerable buf
From: |
GitHub |
Subject: |
[Qemu-commits] [qemu/qemu] edc243: virtio-net: fix guest-triggerable buffer overrun |
Date: |
Fri, 11 Apr 2014 09:00:06 -0700 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: edc243851279e3393000b28b6b69454cae1190ef
https://github.com/qemu/qemu/commit/edc243851279e3393000b28b6b69454cae1190ef
Author: Michael S. Tsirkin <address@hidden>
Date: 2014-04-11 (Fri, 11 Apr 2014)
Changed paths:
M hw/net/virtio-net.c
Log Message:
-----------
virtio-net: fix guest-triggerable buffer overrun
When VM guest programs multicast addresses for
a virtio net card, it supplies a 32 bit
entries counter for the number of addresses.
These addresses are read into tail portion of
a fixed macs array which has size MAC_TABLE_ENTRIES,
at offset equal to in_use.
To avoid overflow of this array by guest, qemu attempts
to test the size as follows:
- if (in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
however, as mac_data.entries is uint32_t, this sum
can overflow, e.g. if in_use is 1 and mac_data.entries
is 0xffffffff then in_use + mac_data.entries will be 0.
Qemu will then read guest supplied buffer into this
memory, overflowing buffer on heap.
CVE-2014-0150
Cc: address@hidden
Signed-off-by: Michael S. Tsirkin <address@hidden>
Message-id: address@hidden
Reviewed-by: Michael Tokarev <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] edc243: virtio-net: fix guest-triggerable buffer overrun,
GitHub <=