projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 9400601) | patch
hw/nvme: fix oob memory read in fdp events log
authorKlaus Jensen <k.jensen@samsung.com>
Thu, 3 Aug 2023 18:44:23 +0000 (20:44 +0200)
committerKlaus Jensen <k.jensen@samsung.com>
Mon, 7 Aug 2023 06:51:37 +0000 (08:51 +0200)
commitecb1b7b082d3b7dceff0e486a114502fc52c0fdf
tree0e5b330cfee52ea9e4ef8877931657cbd06c4c8atree | snapshot
parent9400601a689a128c25fa9c21e932562e0eeb7a26commit | diff
hw/nvme: fix oob memory read in fdp events log

As reported by Trend Micro's Zero Day Initiative, an oob memory read
vulnerability exists in nvme_fdp_events(). The host-provided offset is
not verified.

Fix this.

This is only exploitable when Flexible Data Placement mode (fdp=on) is
enabled.

Fixes: CVE-2023-4135
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reported-by: Trend Micro's Zero Day Initiative
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
hw/nvme/ctrl.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.