From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:33374)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1Z5CyQ-0007Ce-8y
	for qemu-devel@nongnu.org; Wed, 17 Jun 2015 09:01:47 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1Z5CyP-0002RW-CI
	for qemu-devel@nongnu.org; Wed, 17 Jun 2015 09:01:46 -0400
Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
Message-ID: <55816FB2.1030202@redhat.com>
Date: Wed, 17 Jun 2015 15:01:38 +0200
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <20150617104610.GH2422@dhcp-25-225.brq.redhat.com>
In-Reply-To: <20150617104610.GH2422@dhcp-25-225.brq.redhat.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in
	pit_ioport_read()
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Petr Matousek <pmatouse@redhat.com>, qemu-devel@nongnu.org
Cc: mst@redhat.com, qemu-stable@nongnu.org, matttait@google.com



On 17/06/2015 12:46, Petr Matousek wrote:
> Due converting PIO to the new memory read/write api we no longer provide
> separate I/O region lenghts for read and write operations. As a result,
> reading from PIT Mode/Command register will end with accessing
> pit->channels with invalid index.
> 
> Fix this by ignoring read from the Mode/Command register.
> 
> This is CVE-2015-3214.
> 
> Signed-off-by: Petr Matousek <pmatouse@redhat.com>
> Reported-by: Matt Tait <matttait@google.com>

Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052

Applied, thanks.

Paolo

> ---
>  hw/timer/i8254.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
> index 3450c98..9b65a33 100644
> --- a/hw/timer/i8254.c
> +++ b/hw/timer/i8254.c
> @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
>      PITChannelState *s;
>  
>      addr &= 3;
> +
> +    if (addr == 3) {
> +        /* Mode/Command register is write only, read is ignored */
> +        return 0;
> +    }
> +
>      s = &pit->channels[addr];
>      if (s->status_latched) {
>          s->status_latched = 0;
>