[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847)
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847) |
Date: |
Thu, 15 Nov 2018 19:10:38 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.0 |
On 15/11/2018 04:14, Li Qiang wrote:
>
>
> Paolo Bonzini <address@hidden <mailto:address@hidden>> 于2018
> 年11月14日周三 下午11:44写道:
>
> On 14/11/2018 02:38, Li Qiang wrote:
> >
> >
> > Paolo Bonzini <address@hidden <mailto:address@hidden>
> <mailto:address@hidden <mailto:address@hidden>>> 于2018
> > 年11月14日周三 上午2:27写道:
> >
> > On 13/11/2018 11:17, Kevin Wolf wrote:
> > > Am 13.11.2018 um 02:45 hat Li Qiang geschrieben:
> > >> Ping.... what't the status of this patch.
> > >>
> > >> I see Kevin's new pr doesn't contain this patch.
> > >
> > > Oh, I thought you said that you wanted to fix this at a higher
> > level so
> > > that the problem is caught before even getting into nvme
> code? If you
> > > don't, I can apply the patch for my next pull request.
> >
> > As far as I know the bug doesn't exist. Li Qiang, if you have a
> > reproducer please send it.
> >
> >
> > Hello Paolo,
> > Though I've send the debug information and ASAN output in the mail to
> > address@hidden <mailto:address@hidden>
> <mailto:address@hidden <mailto:address@hidden>>, I'm glad
> provide here.
> > This is for read, I think the write the same but as the PoC is in
> > userspace, the mmap can only map the exact size of the MMIO,
> > So we can only write within the area. But if we using a module we can
> > write the out of MMIO I think
> > The nvme device's parameter should set as 'cmb_size_mb=2' and the PCI
> > address may differ in your system.
>
> Ok, thanks. I've created a reproducer using qtest (though I have to run
> now and cannot post it properly).
>
> The patch for the fix is simply:
>
>
> So do you send this or me?
Me, together with the test.
Paolo
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), (continued)
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Keith Busch, 2018/11/02
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Li Qiang, 2018/11/12
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Kevin Wolf, 2018/11/13
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Li Qiang, 2018/11/13
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Paolo Bonzini, 2018/11/13
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Li Qiang, 2018/11/13
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Paolo Bonzini, 2018/11/14
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847), Li Qiang, 2018/11/14
- Re: [Qemu-devel] [PATCH] nvme: fix oob access issue(CVE-2018-16847),
Paolo Bonzini <=