diff options
Diffstat (limited to 'gitlab/issues_text/target_missing/host_missing/accel_missing/646')
| -rw-r--r-- | gitlab/issues_text/target_missing/host_missing/accel_missing/646 | 18 |
1 files changed, 0 insertions, 18 deletions
diff --git a/gitlab/issues_text/target_missing/host_missing/accel_missing/646 b/gitlab/issues_text/target_missing/host_missing/accel_missing/646 deleted file mode 100644 index b462ef18d..000000000 --- a/gitlab/issues_text/target_missing/host_missing/accel_missing/646 +++ /dev/null @@ -1,18 +0,0 @@ -Infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c (CVE-2020-14394) -Description of problem: -An infinite loop issue was found in the USB xHCI controller emulation of QEMU. Specifically, function `xhci_ring_chain_length()` in hw/usb/hcd-xhci.c may get stuck while fetching empty TRBs from guest memory, since the exit conditions of the loop depend on values that are fully controlled by guest. A privileged guest user may exploit this issue to hang the QEMU process on the host, resulting in a denial of service. -Steps to reproduce: -Build and load `xhci.ko` from within the guest: - -1) make -2) insmod xhci.ko - -[Makefile](/uploads/98dbf7b4facc9b100817b3c8f63b5cb2/Makefile) - -[usb-xhci.h](/uploads/f225524b1553d8cf6c1dfa89369b6edc/usb-xhci.h) - -[xhci.c](/uploads/c635f742d12a2bba6ea472ddfe006d56/xhci.c) -Additional information: -This issue was reported by Gaoning Pan (Zhejiang University) and Xingwei Li (Ant Security Light-Year Lab). - -RH bug: https://bugzilla.redhat.com/show_bug.cgi?id=1908004. |