mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
adbbddf90b
qemu/hw
History
Yuval Shaia af566ccb38 hw/pvrdma: Protect against buggy or malicious guest driver 
Guest driver allocates and initialize page tables to be used as a ring
of descriptors for CQ and async events.
The page table that represents the ring, along with the number of pages
in the page table is passed to the device.
Currently our device supports only one page table for a ring.

Let's make sure that the number of page table entries the driver
reports, do not exceeds the one page table size.

Reported-by: Soul Chen <soulchen8650@gmail.com>
Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Fixes: CVE-2023-1544
Message-ID: <20230301142926.18686-1-yuval.shaia.ml@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 85fc35afa9)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-10-19 14:52:59 +03:00
..
9pfs hw/9pfs: spelling fixes 2023-07-25 17:15:47 +03:00
acpi
adc
alpha
arm hw/arm/boot: Set SCR_EL3.FGTEn when booting kernel 2023-10-03 02:00:54 +03:00
audio hw/audio/es1370: reset current sample counter 2023-10-12 01:10:13 +03:00
avr
block xen-block: Avoid leaks on new error path 2023-08-01 10:22:33 +01:00
char hw/char/riscv_htif: Fix the console syscall on big endian hosts 2023-09-21 19:35:19 +03:00
core misc: Fix some typos in documentation and comments 2023-08-01 23:52:23 +02:00
cpu
cris
cxl hw/cxl: Fix CFMW config memory leak 2023-10-03 02:00:54 +03:00
display hw/display/ramfb: plug slight guest-triggerable leak on mode setting 2023-10-05 08:44:22 +03:00
dma
gpio
hppa
hyperv
i2c hw/i2c/aspeed: Fix TXBUF transmission start position error 2023-09-21 19:35:19 +03:00
i386 amd_iommu: Fix APIC address check 2023-10-06 15:36:37 +03:00
ide hw/ide/ahci: fix broken SError handling 2023-09-21 19:35:19 +03:00
input
intc hw/intc: Make rtc variable names consistent 2023-09-21 19:35:19 +03:00
ipack
ipmi
isa hw/isa/vt82c686: Remove via_isa_set_irq() 2023-07-11 00:11:25 +02:00
loongarch hw/loongarch/virt: Use machine_memory_devices_init() 2023-07-12 09:25:37 +02:00
m68k other architectures: spelling fixes 2023-07-25 17:14:07 +03:00
mem memory-device: Track used region size in DeviceMemoryState 2023-07-12 09:25:37 +02:00
microblaze other architectures: spelling fixes 2023-07-25 17:14:07 +03:00
mips kvm: Introduce kvm_arch_get_default_type hook 2023-08-24 18:43:47 +03:00
misc arm: spelling fixes 2023-07-25 17:13:53 +03:00
net hw/net/vmxnet3: Fix guest-triggerable assert() 2023-09-21 19:35:19 +03:00
nios2
nubus
nvme hw/nvme: fix null pointer access in ruh update 2023-08-09 15:32:32 +02:00
nvram hw/nvram: Avoid unnecessary Xilinx eFuse backstore write 2023-07-17 11:05:52 +01:00
openrisc
pci pci: Fix the update of interrupt disable bit in PCI_COMMAND register 2023-08-11 12:15:24 -04:00
pci-bridge hw/pci-bridge/cxl_upstream.c: Use g_new0() in build_cdat_table() 2023-08-03 16:06:49 -04:00
pci-host hw/pci-host: Allow extended config space access for Designware PCIe host 2023-08-11 12:15:24 -04:00
pcmcia
ppc hw/ppc: Read time only once to perform decrementer write 2023-09-25 23:44:30 +03:00
rdma hw/pvrdma: Protect against buggy or malicious guest driver 2023-10-19 14:52:59 +03:00
remote
riscv hw/riscv: virt: Fix riscv,pmu DT node path 2023-09-21 19:35:19 +03:00
rtc
rx
s390x s390x/ap: fix missing subsystem reset registration 2023-09-21 19:35:19 +03:00
scsi scsi-disk: ensure that FORMAT UNIT commands are terminated 2023-10-03 18:25:13 +03:00
sd hw/sd/sdhci: Do not force sdhci_mmio_*_ops onto all SD controllers 2023-07-25 14:40:49 +02:00
sensor
sh4
smbios hw/smbios: Fix core count in type4 2023-07-10 16:17:08 -04:00
sparc other architectures: spelling fixes 2023-07-25 17:14:07 +03:00
sparc64 hw/pci/pci: Remove multifunction parameter from pci_new_multifunction() 2023-07-10 18:59:32 -04:00
ssi
timer
tpm hw/tpm: TIS on sysbus: Remove unsupport ppi command line option 2023-07-14 11:31:54 -04:00
tricore
usb hw/usb/canokey: change license to GPLv2+ 2023-07-25 17:24:12 +01:00
vfio vfio/display: Fix missing update to set backing fields 2023-10-10 07:37:45 +03:00
virtio virtio: Drop out of coroutine context in virtio_load() 2023-09-21 19:35:19 +03:00
watchdog
xen xen: Don't pass MemoryListener around by value 2023-08-01 10:22:33 +01:00
xenpv
xtensa hw: Simplify calls to pci_nic_init_nofail() 2023-07-08 07:24:38 +03:00
Kconfig
meson.build