[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] f2609f: i2c: pm_smbus: check smb_index before
From: |
GitHub |
Subject: |
[Qemu-commits] [qemu/qemu] f2609f: i2c: pm_smbus: check smb_index before block transf... |
Date: |
Thu, 06 Dec 2018 08:45:38 -0800 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: f2609ffdf39bcd4f89b5f67b33347490023a7a84
https://github.com/qemu/qemu/commit/f2609ffdf39bcd4f89b5f67b33347490023a7a84
Author: Prasad J Pandit <address@hidden>
Date: 2018-12-06 (Thu, 06 Dec 2018)
Changed paths:
M hw/i2c/pm_smbus.c
Log Message:
-----------
i2c: pm_smbus: check smb_index before block transfer write
While performing block transfer write in smb_ioport_writeb(),
'smb_index' is incremented and used to index smb_data[] array.
Check 'smb_index' value to avoid OOB access.
Note that this bug is exploitable by a guest to escape
from the virtual machine. However the commit which
introduced the bug was only made after the 3.0 release,
and so it is not present in any released QEMU versions.
Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability
Reported-by: Michael Hanselmann <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Reviewed-by: Igor Mammedov <address@hidden>
Reviewed-by: Li Qiang <address@hidden>
Reviewed-by: Michael Hanselmann <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
**NOTE:** This service has been marked for deprecation:
https://developer.github.com/changes/2018-04-25-github-services-deprecation/
Functionality will be removed from GitHub.com on January 31st, 2019.
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] f2609f: i2c: pm_smbus: check smb_index before block transf...,
GitHub <=