tree 0e5b330cfee52ea9e4ef8877931657cbd06c4c8a
parent 9400601a689a128c25fa9c21e932562e0eeb7a26
author Klaus Jensen <k.jensen@samsung.com> 1691088263 +0200
committer Klaus Jensen <k.jensen@samsung.com> 1691391097 +0200

hw/nvme: fix oob memory read in fdp events log

As reported by Trend Micro's Zero Day Initiative, an oob memory read
vulnerability exists in nvme_fdp_events(). The host-provided offset is
not verified.

Fix this.

This is only exploitable when Flexible Data Placement mode (fdp=on) is
enabled.

Fixes: CVE-2023-4135
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reported-by: Trend Micro's Zero Day Initiative
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>