Michael S. Tsirkin 36cf2a3713 virtio: validate num_sg when mapping ... CVE-2013-4535 CVE-2013-4536 Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueue_map_sg(), where num_sg is taken from the wire and can force writes to indicies beyond VIRTQUEUE_MAX_SIZE. To fix, validate num_sg. Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Cc: Amit Shah <amit.shah@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>		2014-05-05 22:15:02 +02:00
..
dataplane	dataplane: fix shadowed return value	2014-01-22 13:48:18 +01:00
Makefile.objs	virtio: Implement MMIO based virtio transport	2013-07-19 12:58:47 +01:00
vhost.c	vhost: clear signalled_used_valid on vhost stop	2013-08-12 12:25:17 +03:00
virtio-balloon.c	virtio-balloon: don't hardcode config size value	2014-01-15 23:34:17 +04:00
virtio-bus.c	virtio-bus: cleanup plug/unplug interface	2013-12-09 21:46:48 +01:00
virtio-mmio.c	virtio-bus: remove vdev field	2013-12-09 21:46:48 +01:00
virtio-pci.c	qom: Add check() argument to object_property_add_link()	2014-03-19 22:23:13 +01:00
virtio-pci.h	virtio-pci: remove vdev field	2013-12-09 21:46:48 +01:00
virtio-rng.c	virtio-rng: Avoid default_backend refcount leak	2014-03-19 22:23:47 +01:00
virtio.c	virtio: validate num_sg when mapping	2014-05-05 22:15:02 +02:00