diff options
Diffstat (limited to 'results/classifier/105/device/1810956')
| -rw-r--r-- | results/classifier/105/device/1810956 | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/results/classifier/105/device/1810956 b/results/classifier/105/device/1810956 new file mode 100644 index 00000000..f06ad082 --- /dev/null +++ b/results/classifier/105/device/1810956 @@ -0,0 +1,30 @@ +device: 0.761 +boot: 0.693 +graphic: 0.667 +instruction: 0.605 +network: 0.537 +socket: 0.478 +vnc: 0.441 +semantic: 0.369 +mistranslation: 0.293 +other: 0.217 +KVM: 0.076 +assembly: 0.070 + +qemu-2.12.1 crashes when running malicious bootloader. + +Running specific bootloader on Qemu causes fatal error and +hence SIGABRT in /qemu-2.12.1/tcg/tcg.c on line 2684. + +Bootloader binary code is included in attachments. +The code was generated by assembling a valid bootloader, then +appending random-bytes from file `/dev/urandom` to the binary file. + + + +This is a bug, obviously, but note that we do not guarantee TCG binary translation to be a security boundary against malicious code. Don't run guest code you don't trust inside TCG without further sandboxing around QEMU. (Much of the code that runs in a TCG configuration is old and unaudited, so there may be lurking bugs. Configurations using KVM are the only ones where we treat guest escapes as security bugs.) + + +I think this bug was fixed in QEMU 3.1 -- I can reproduce the assert on 3.0 but not on 3.1. + + |