summary refs log tree commit diff stats
path: root/results/classifier/105/device/1171
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-06-03 12:04:13 +0000
committerChristian Krinitsin <mail@krinitsin.com>2025-06-03 12:04:13 +0000
commit256709d2eb3fd80d768a99964be5caa61effa2a0 (patch)
tree05b2352fba70923126836a64b6a0de43902e976a /results/classifier/105/device/1171
parent2ab14fa96a6c5484b5e4ba8337551bb8dcc79cc5 (diff)
downloademulator-bug-study-256709d2eb3fd80d768a99964be5caa61effa2a0.tar.gz
emulator-bug-study-256709d2eb3fd80d768a99964be5caa61effa2a0.zip
add new classifier result
Diffstat (limited to 'results/classifier/105/device/1171')
-rw-r--r--results/classifier/105/device/117116
1 files changed, 16 insertions, 0 deletions
diff --git a/results/classifier/105/device/1171 b/results/classifier/105/device/1171
new file mode 100644
index 00000000..72f62a40
--- /dev/null
+++ b/results/classifier/105/device/1171
@@ -0,0 +1,16 @@
+device: 0.893
+instruction: 0.797
+network: 0.707
+graphic: 0.528
+boot: 0.357
+other: 0.306
+semantic: 0.293
+socket: 0.150
+mistranslation: 0.096
+vnc: 0.086
+assembly: 0.060
+KVM: 0.003
+
+tulip: DMA reentrancy issue leads to stack overflow (CVE-2022-2962)
+Description of problem:
+A DMA reentrancy issue was found in the tulip emulation. When tulip reads or writes to  rx/tx descriptor ( tulip_desc_read/write ) or copies  rx/tx frame(tulip_copy_rx_bytes / tulip_copy_tx_buffers), it doesn't check whether the destination address is its own MMIO address. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.