[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2 1/2] ait-vga: check address before reading configuration b
From: |
P J P |
Subject: |
Re: [PATCH v2 1/2] ait-vga: check address before reading configuration bytes |
Date: |
Thu, 4 Jun 2020 14:48:59 +0530 (IST) |
Hello Phil,
+-- On Thu, 4 Jun 2020, Philippe Mathieu-Daudé wrote --+
| >> @@ -1381,6 +1381,8 @@ uint32_t pci_default_read_config(PCIDevice *d,
| >> + assert(address + len <= pci_config_size(d));
|
| Yes, maybe I was not clear while reviewing v1, we need to audit the
| callers and fix them first, then we can safely add the assert here.
That's an elaborate task. Could we please make that into another patch series?
+-- On Thu, 4 Jun 2020, Daniel P. Berrangé wrote --+
| On Thu, Jun 04, 2020 at 01:52:50AM +0530, P J P wrote:
| > While reading PCI configuration bytes, a guest may send an
| > address towards the end of the configuration space. It may lead
| > to an OOB access issue. Add check to ensure 'address + size' is
| > within PCI configuration space.
|
| Please include a CVE number for this security flaw if there is
| one.
Yes. For now I'll send a revised patch to fix this ati-vga OOB access issue.
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
- [PATCH v2 0/2] Ensure PCI configuration access is within bounds, P J P, 2020/06/03
- [PATCH v2 2/2] pci: ensure configuration access is within bounds, P J P, 2020/06/03
- Re: [PATCH v2 2/2] pci: ensure configuration access is within bounds, BALATON Zoltan, 2020/06/03
- Re: [PATCH v2 2/2] pci: ensure configuration access is within bounds, P J P, 2020/06/04
- Re: [PATCH v2 2/2] pci: ensure configuration access is within bounds, Philippe Mathieu-Daudé, 2020/06/04
- Re: [PATCH v2 2/2] pci: ensure configuration access is within bounds, Michael S. Tsirkin, 2020/06/04
- Re: [PATCH v2 2/2] pci: ensure configuration access is within bounds, BALATON Zoltan, 2020/06/04
- Re: [PATCH v2 2/2] pci: ensure configuration access is within bounds, Michael S. Tsirkin, 2020/06/04