diff options
| author | Petr Matousek <pmatouse@redhat.com> | 2015-06-17 12:46:11 +0200 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-07-29 18:40:21 -0500 |
| commit | 49ef542e41526218fa28bf8762f95387a1cc4ccf (patch) | |
| tree | cffff397a679d54fcd5445a0f72ec639a6299a32 | |
| parent | c270245a53d6706131307673cb082826719228d1 (diff) | |
| download | qemu-49ef542e41526218fa28bf8762f95387a1cc4ccf.tar.gz | |
i8254: fix out-of-bounds memory access in pit_ioport_read()
Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.
Fix this by ignoring read from the Mode/Command register.
This is CVE-2015-3214.
Reported-by: Matt Tait <matttait@google.com>
Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
Cc: qemu-stable@nongnu.org
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d4862a87e31a51de9eb260f25c9e99a75efe3235)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/timer/i8254.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c index 3450c98637..9b65a33692 100644 --- a/hw/timer/i8254.c +++ b/hw/timer/i8254.c @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr, PITChannelState *s; addr &= 3; + + if (addr == 3) { + /* Mode/Command register is write only, read is ignored */ + return 0; + } + s = &pit->channels[addr]; if (s->status_latched) { s->status_latched = 0; |