diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-05-30 16:52:07 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-05-30 16:52:17 +0200 |
| commit | 9260319e7411ff8281700a532caa436f40120ec4 (patch) | |
| tree | 2f6bfe5f3458dd49d328d3a9eb508595450adec0 /gitlab/issues/target_missing/host_missing/accel_missing/646.toml | |
| parent | 225caa38269323af1bfc2daadff5ec8bd930747f (diff) | |
| download | qemu-analysis-9260319e7411ff8281700a532caa436f40120ec4.tar.gz qemu-analysis-9260319e7411ff8281700a532caa436f40120ec4.zip | |
gitlab scraper: download in toml and text format
Diffstat (limited to 'gitlab/issues/target_missing/host_missing/accel_missing/646.toml')
| -rw-r--r-- | gitlab/issues/target_missing/host_missing/accel_missing/646.toml | 26 |
1 files changed, 0 insertions, 26 deletions
diff --git a/gitlab/issues/target_missing/host_missing/accel_missing/646.toml b/gitlab/issues/target_missing/host_missing/accel_missing/646.toml deleted file mode 100644 index b47e7f9a9..000000000 --- a/gitlab/issues/target_missing/host_missing/accel_missing/646.toml +++ /dev/null @@ -1,26 +0,0 @@ -id = 646 -title = "Infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c (CVE-2020-14394)" -state = "closed" -created_at = "2021-09-28T12:49:47.888Z" -closed_at = "2022-08-16T18:23:56.604Z" -labels = ["Security", "TestCase", "USB", "workflow::In Progress"] -url = "https://gitlab.com/qemu-project/qemu/-/issues/646" -host-os = "Fedora 33" -host-arch = "x86" -qemu-version = "6.1.50 (v6.1.0-861-g22651bced7)" -guest-os = "Fedora 32" -guest-arch = "x86" -description = """An infinite loop issue was found in the USB xHCI controller emulation of QEMU. Specifically, function `xhci_ring_chain_length()` in hw/usb/hcd-xhci.c may get stuck while fetching empty TRBs from guest memory, since the exit conditions of the loop depend on values that are fully controlled by guest. A privileged guest user may exploit this issue to hang the QEMU process on the host, resulting in a denial of service.""" -reproduce = """Build and load `xhci.ko` from within the guest: - -1) make -2) insmod xhci.ko - -[Makefile](/uploads/98dbf7b4facc9b100817b3c8f63b5cb2/Makefile) - -[usb-xhci.h](/uploads/f225524b1553d8cf6c1dfa89369b6edc/usb-xhci.h) - -[xhci.c](/uploads/c635f742d12a2bba6ea472ddfe006d56/xhci.c)""" -additional = """This issue was reported by Gaoning Pan (Zhejiang University) and Xingwei Li (Ant Security Light-Year Lab). - -RH bug: https://bugzilla.redhat.com/show_bug.cgi?id=1908004.""" |