Re: [Qemu-devel] [PATCH 0/1] display/bochs: fix pcie support (qemu security issue)

[Peter Maydell]

On Mon, 12 Aug 2019 at 13:51, Philippe Mathieu-Daudé <address@hidden> wrote:
>
> On 8/12/19 2:45 PM, Paolo Bonzini wrote:
> > On 12/08/19 08:52, Gerd Hoffmann wrote:
> >> Just found while investigating
> >>   https://bugzilla.redhat.com/show_bug.cgi?id=1707118
> >>
> >> Found PCIe extended config space filled with random crap due to
> >> allocation being too small (conventional pci config space only).
> >>
>
> Can you amend this information to the commit description?
>
> <...
>
> >> PCI(e) config space is guest writable.  Writes are limited by
> >> write mask (which probably is also filled with random stuff),
> >
> > Yes, it is also allocated with 256 bytes only.
> >
> >> so the guest can only flip enabled bits.  But I suspect it
> >> still might be exploitable, so rather serious because it might
> >> be a host escape for the guest.  On the other hand the device
> >> is probably not yet in widespread use.
>
> ...>

I can add to the commit this paragraph of the cover letter,
and I think also the 'mitigation' note might as well go in.

I've also put the cc:stable into the commit message.

Updated commit, ready to apply to master if we're OK with it:

https://git.linaro.org/people/peter.maydell/qemu-arm.git/commit/?h=staging&id=c075b5f318a8be628ab8edf93be33f5a93a4aacd

thanks
-- PMM