From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43)
	id 1IyHHI-0001Nw-9U
	for qemu-devel@nongnu.org; Fri, 30 Nov 2007 20:36:20 -0500
Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43)
	id 1IyHHD-0001Lz-O1
	for qemu-devel@nongnu.org; Fri, 30 Nov 2007 20:36:19 -0500
Received: from [199.232.76.173] (helo=monty-python.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1IyHHD-0001Lf-D8
	for qemu-devel@nongnu.org; Fri, 30 Nov 2007 20:36:15 -0500
Received: from kuber.nabble.com ([216.139.236.158])
	by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32)
	(Exim 4.60) (envelope-from <bounces@nabble.com>) id 1IyHHD-0006ok-9t
	for qemu-devel@nongnu.org; Fri, 30 Nov 2007 20:36:15 -0500
Received: from isper.nabble.com ([192.168.236.156])
	by kuber.nabble.com with esmtp (Exim 4.63)
	(envelope-from <bounces@nabble.com>) id 1IyHHB-0001Gk-NR
	for qemu-devel@nongnu.org; Fri, 30 Nov 2007 17:36:13 -0800
Message-ID: <14101223.post@talk.nabble.com>
Date: Fri, 30 Nov 2007 17:36:13 -0800 (PST)
From: TeLeMan <geleman@gmail.com>
Subject: Re: [Qemu-devel] [security bug]code_gen_buffer can be overflowed
In-Reply-To: <f43fc5580711300804k47409157yd795727a659533dd@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
References: <13985284.post@talk.nabble.com>
	<f43fc5580711300804k47409157yd795727a659533dd@mail.gmail.com>
Reply-To: qemu-devel@nongnu.org
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.gnu.org/pipermail/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org



Blue Swirl-2 wrote:
> 
> On 11/28/07, TeLeMan <geleman@gmail.com> wrote:
>>
>> dyngen_code() can generate more than CODE_GEN_MAX_SIZE bytes,
>> code_gen_buffer
>> can be overflowed. I hope this security bug will be fixed soon.
> 
> Thank you for the analysis. It's true that cpu_gen_code does not pass
> CODE_GEN_MAX_SIZE (65536) on to gen_intermediate_code and that should
> be fixed. But gen_intermediate_code can only add OPC_MAX_SIZE (512 -
> 32) instructions more, so there is no security bug.
> 
> 

This POC is a windows exe and was tested on QEMU v0.9.0 (Guest OS is Windows
XP SP2).
This overflow will overwrite the TranslationBlock buffer.

http://www.nabble.com/file/p14101223/qemu-dos.rar qemu-dos.rar 
-- 
View this message in context: http://www.nabble.com/-security-bug-code_gen_buffer-can-be-overflowed-tf4886083.html#a14101223
Sent from the QEMU - Dev mailing list archive at Nabble.com.