| Message ID | 20150617104610.GH2422@dhcp-25-225.brq.redhat.com |
|---|---|
| State | New |
| Headers | show |
On 17/06/2015 12:46, Petr Matousek wrote: > Due converting PIO to the new memory read/write api we no longer provide > separate I/O region lenghts for read and write operations. As a result, > reading from PIT Mode/Command register will end with accessing > pit->channels with invalid index. > > Fix this by ignoring read from the Mode/Command register. > > This is CVE-2015-3214. > > Signed-off-by: Petr Matousek <pmatouse@redhat.com> > Reported-by: Matt Tait <matttait@google.com> Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052 Applied, thanks. Paolo > --- > hw/timer/i8254.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c > index 3450c98..9b65a33 100644 > --- a/hw/timer/i8254.c > +++ b/hw/timer/i8254.c > @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr, > PITChannelState *s; > > addr &= 3; > + > + if (addr == 3) { > + /* Mode/Command register is write only, read is ignored */ > + return 0; > + } > + > s = &pit->channels[addr]; > if (s->status_latched) { > s->status_latched = 0; >
diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c index 3450c98..9b65a33 100644 --- a/hw/timer/i8254.c +++ b/hw/timer/i8254.c @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr, PITChannelState *s; addr &= 3; + + if (addr == 3) { + /* Mode/Command register is write only, read is ignored */ + return 0; + } + s = &pit->channels[addr]; if (s->status_latched) { s->status_latched = 0;
Due converting PIO to the new memory read/write api we no longer provide separate I/O region lenghts for read and write operations. As a result, reading from PIT Mode/Command register will end with accessing pit->channels with invalid index. Fix this by ignoring read from the Mode/Command register. This is CVE-2015-3214. Signed-off-by: Petr Matousek <pmatouse@redhat.com> Reported-by: Matt Tait <matttait@google.com> --- hw/timer/i8254.c | 6 ++++++ 1 file changed, 6 insertions(+)