Emulation/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2025-04-02 11:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity
xemu/hw/i2c
History
Prasad J Pandit f2609ffdf3 i2c: pm_smbus: check smb_index before block transfer write 
While performing block transfer write in smb_ioport_writeb(),
'smb_index' is incremented and used to index smb_data[] array.
Check 'smb_index' value to avoid OOB access.

Note that this bug is exploitable by a guest to escape
from the virtual machine. However the commit which
introduced the bug was only made after the 3.0 release,
and so it is not present in any released QEMU versions.

Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability
Reported-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20181206121830.6177-1-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-06 15:51:57 +00:00
..
aspeed_i2c.c aspeed/i2c: Fix receive done interrupt handling 2018-09-25 14:14:07 +01:00
bitbang_i2c.c hw/i2c/bitbang_i2c: Handle NACKs from devices 2016-11-07 10:01:15 +00:00
bitbang_i2c.h i2c: Rename i2c_bus to I2CBus 2014-02-14 16:22:31 +01:00
core.c hw/i2c: Add trace events 2018-06-08 13:15:33 +01:00
exynos4210_i2c.c hw/i2c: QOM'ify exynos4210_i2c.c 2016-06-14 15:59:13 +01:00
i2c-ddc.c i2c: switch ddc to use the new edid generator 2018-10-15 09:57:33 +02:00
imx_i2c.c arm: Uniquely name imx25 I2C buses. 2017-01-20 11:15:06 +00:00
Makefile.objs i2c: Add a CONFIG_I2C master switch to the configuration files 2018-02-05 18:09:45 +01:00
omap_i2c.c hw/i2c/omap_i2c: Use qemu_log_mask(UNIMP) instead of fprintf 2018-06-26 17:50:40 +01:00
pm_smbus.c i2c: pm_smbus: check smb_index before block transfer write 2018-12-06 15:51:57 +00:00
ppc4xx_i2c.c ppc4xx_i2c: Rewrite to model hardware more closely 2018-07-03 09:56:52 +10:00
smbus.c i2c: Add a length check to the SMBus write handling 2018-12-03 13:00:38 +00:00
smbus_eeprom.c smbus: add a smbus_eeprom_init_one() routine 2018-06-08 13:15:32 +01:00
smbus_ich9.c i2c: pm_smbus: Add the ability to force block transfer enable 2018-08-23 18:46:25 +02:00
trace-events hw/i2c: Add trace events 2018-06-08 13:15:33 +01:00
versatile_i2c.c hw/i2c: QOM'ify versatile_i2c.c 2016-06-14 15:59:13 +01:00