diff options
Diffstat (limited to 'results/scraper/launchpad/1810956')
| -rw-r--r-- | results/scraper/launchpad/1810956 | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/results/scraper/launchpad/1810956 b/results/scraper/launchpad/1810956 new file mode 100644 index 00000000..371c8056 --- /dev/null +++ b/results/scraper/launchpad/1810956 @@ -0,0 +1,17 @@ +qemu-2.12.1 crashes when running malicious bootloader. + +Running specific bootloader on Qemu causes fatal error and +hence SIGABRT in /qemu-2.12.1/tcg/tcg.c on line 2684. + +Bootloader binary code is included in attachments. +The code was generated by assembling a valid bootloader, then +appending random-bytes from file `/dev/urandom` to the binary file. + + + +This is a bug, obviously, but note that we do not guarantee TCG binary translation to be a security boundary against malicious code. Don't run guest code you don't trust inside TCG without further sandboxing around QEMU. (Much of the code that runs in a TCG configuration is old and unaudited, so there may be lurking bugs. Configurations using KVM are the only ones where we treat guest escapes as security bugs.) + + +I think this bug was fixed in QEMU 3.1 -- I can reproduce the assert on 3.0 but not on 3.1. + + |