diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2014-04-03 19:51:53 +0300 |
|---|---|---|
| committer | Juan Quintela <quintela@redhat.com> | 2014-05-05 22:15:02 +0200 |
| commit | 36cf2a37132c7f01fa9adb5f95f5312b27742fd4 (patch) | |
| tree | a8e8acc36af8e26822915f3a919c858f09bb6d77 /hw/gpio | |
| parent | 4b53c2c72cb5541cf394033b528a6fe2a86c0ac1 (diff) | |
| download | focaccia-qemu-36cf2a37132c7f01fa9adb5f95f5312b27742fd4.tar.gz focaccia-qemu-36cf2a37132c7f01fa9adb5f95f5312b27742fd4.zip | |
virtio: validate num_sg when mapping
CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
Diffstat (limited to 'hw/gpio')
0 files changed, 0 insertions, 0 deletions