Google Git
Sign in
qemu / qemu / a98610c429d52db0937c1e48659428929835c455
commita98610c429d52db0937c1e48659428929835c455[log] [tgz]
authorPrasad J Pandit <pjp@fedoraproject.org>Thu Jun 04 14:38:30 2020 +0530
committerGerd Hoffmann <kraxel@redhat.com>Fri Jun 05 09:14:40 2020 +0200
treea161aed3e9c0d0163faa5413db74f6f5ac7b60aa
parent66234fee9c2d37bfbc523aa8d0ae5300a14cc10e [diff]
ati-vga: check mm_index before recursive call (CVE-2020-13800)

While accessing VGA registers via ati_mm_read/write routines,
a guest may set 's->regs.mm_index' such that it leads to infinite
recursion. Check mm_index value to avoid such recursion. Log an
error message for wrong values.

Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Yi Ren <c4tren@gmail.com>
Message-id: 20200604090830.33885-1-ppandit@redhat.com
Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
1 file changed
tree: a161aed3e9c0d0163faa5413db74f6f5ac7b60aa
  1. .github/
  2. .gitlab-ci.d/
  3. accel/
  4. audio/
  5. authz/
  6. backends/
  7. block/
  8. bsd-user/
  9. chardev/
  10. contrib/
  11. crypto/
  12. default-configs/
  13. disas/
  14. docs/
  15. dump/
  16. fpu/
  17. fsdev/
  18. gdb-xml/
  19. hw/
  20. include/
  21. io/
  22. libdecnumber/
  23. linux-headers/
  24. linux-user/
  25. migration/
  26. monitor/
  27. nbd/
  28. net/
  29. pc-bios/
  30. plugins/
  31. po/
  32. python/
  33. qapi/
  34. qga/
  35. qobject/
  36. qom/
  37. replay/
  38. roms/
  39. scripts/
  40. scsi/
  41. softmmu/
  42. storage-daemon/
  43. stubs/
  44. target/
  45. tcg/
  46. tests/
  47. tools/
  48. trace/
  49. ui/
  50. util/
  51. capstone
  52. dtc
  53. slirp
  54. .cirrus.yml
  55. .dir-locals.el
  56. .editorconfig
  57. .exrc
  58. .gdbinit
  59. .gitignore
  60. .gitlab-ci.yml
  61. .gitmodules
  62. .gitpublish
  63. .mailmap
  64. .patchew.yml
  65. .readthedocs.yml
  66. .shippable.yml
  67. .travis.yml
  68. arch_init.c
  69. balloon.c
  70. block.c
  71. blockdev-nbd.c
  72. blockdev.c
  73. blockjob.c
  74. bootdevice.c
  75. Changelog
  76. CODING_STYLE.rst
  77. configure
  78. COPYING
  79. COPYING.LIB
  80. cpus-common.c
  81. cpus.c
  82. device_tree.c
  83. disas.c
  84. dma-helpers.c
  85. exec-vary.c
  86. exec.c
  87. gdbstub.c
  88. gitdm.config
  89. hmp-commands-info.hx
  90. hmp-commands.hx
  91. ioport.c
  92. iothread.c
  93. job-qmp.c
  94. job.c
  95. Kconfig.host
  96. LICENSE
  97. MAINTAINERS
  98. Makefile
  99. Makefile.objs
  100. Makefile.target
  101. memory.c
  102. memory_ldst.inc.c
  103. memory_mapping.c
  104. module-common.c
  105. os-posix.c
  106. os-win32.c
  107. qdev-monitor.c
  108. qemu-bridge-helper.c
  109. qemu-edid.c
  110. qemu-img-cmds.hx
  111. qemu-img.c
  112. qemu-io-cmds.c
  113. qemu-io.c
  114. qemu-keymap.c
  115. qemu-nbd.c
  116. qemu-options-wrapper.h
  117. qemu-options.h
  118. qemu-options.hx
  119. qemu-seccomp.c
  120. qemu-storage-daemon.c
  121. qemu.nsi
  122. qemu.sasl
  123. qtest.c
  124. README.rst
  125. replication.c
  126. replication.h
  127. rules.mak
  128. thunk.c
  129. tpm.c
  130. trace-events
  131. VERSION
  132. version.rc