mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
d4f510eb3f
qemu/hw/display
History
Gerd Hoffmann fd3c136b3e vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). 
Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
registers, to make sure the vga registers will always have the
values needed by vbe mode.  This makes sure the sanity checks
applied by vbe_fixup_regs() are effective.

Without this guests can muck with shift_control, can turn on planar
vga modes or text mode emulation while VBE is active, making qemu
take code paths meant for CGA compatibility, but with the very
large display widths and heigts settable using VBE registers.

Which is good for one or another buffer overflow.  Not that
critical as they typically read overflows happening somewhere
in the display code.  So guests can DoS by crashing qemu with a
segfault, but it is probably not possible to break out of the VM.

Fixes: CVE-2016-3712
Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
Reported-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2016-05-02 16:02:59 +02:00
..
ads7846.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
bcm2835_fb.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
blizzard_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
blizzard.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
cg3.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
cirrus_vga_rop2.h hw: move private headers to hw/ subdirectories. 2013-04-08 18:13:16 +02:00
cirrus_vga_rop.h cirrus: Fix host CPU blits 2014-07-11 10:17:02 +02:00
cirrus_vga.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
exynos4210_fimd.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
framebuffer.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
framebuffer.h framebuffer: set DIRTY_MEMORY_VGA on RAM that is used for the framebuffer 2015-07-24 13:57:45 +02:00
g364fb.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
jazz_led.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
Makefile.objs bcm2835_fb: add framebuffer device for Raspberry Pi 2016-03-16 17:42:18 +00:00
milkymist-tmu2.c lm32: Clean up includes 2016-01-29 15:07:22 +00:00
milkymist-vgafb_template.h milkymist-vgafb: swap pixel data in source buffer 2014-02-04 19:34:30 +01:00
milkymist-vgafb.c lm32: Clean up includes 2016-01-29 15:07:22 +00:00
omap_dss.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
omap_lcd_template.h arm: explicitly mark device loads as little-endian 2015-12-17 13:37:13 +00:00
omap_lcdc.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
pl110_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
pl110.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
pxa2xx_lcd.c arm: Clean up includes 2016-01-29 15:07:23 +00:00
pxa2xx_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
qxl-logger.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl-render.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
qxl.c qxl: lock current_async update in qxl_soft_reset 2016-03-01 07:51:32 +01:00
qxl.h qxl: allow to specify head limit to qxl driver 2015-07-16 17:31:05 +02:00
sm501_template.h hw: use ld_p/st_p instead of ld_raw/st_raw 2014-06-05 16:04:17 +02:00
sm501.c hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
ssd0303.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
ssd0323.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
tc6393xb_template.h display: avoid multi-statement macro 2014-01-31 14:47:33 +00:00
tc6393xb.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
tcx.c hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
vga_int.h all: Clean up includes 2016-02-23 12:43:05 +00:00
vga-helpers.h vga: Rename vga_template.h to vga-helpers.h 2014-09-30 13:34:09 +02:00
vga-isa-mm.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga-isa.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga-pci.c hw/display: Clean up includes 2016-01-29 15:07:24 +00:00
vga.c vga: make sure vga register setup for vbe stays intact (CVE-2016-3712). 2016-05-02 16:02:59 +02:00
vga.h hw: move private headers to hw/ subdirectories. 2013-04-08 18:13:16 +02:00
virtio-gpu-3d.c virtio-gpu: block any rendering until client (ui) is done 2016-02-03 10:41:36 +01:00
virtio-gpu-pci.c virtio: Clean up includes 2016-01-29 15:07:23 +00:00
virtio-gpu.c virtio-gpu: block live migration 2016-04-11 12:36:34 +02:00
virtio-vga.c virtio-gpu: block any rendering until client (ui) is done 2016-02-03 10:41:36 +01:00
vmware_vga.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
xenfb.c xenfb: use the correct condition to avoid excessive looping 2016-04-12 10:16:08 -07:00