diff options
| author | Gerd Hoffmann | 2021-08-18 14:05:05 +0200 |
|---|---|---|
| committer | Gerd Hoffmann | 2021-09-01 06:34:00 +0200 |
| commit | 13b250b12ad3c59114a6a17d59caf073ce45b33a (patch) | |
| tree | 0f79d14314c1c36f499a29e2eedaf5ff5b7626c9 /hw/arm/stm32vldiscovery.c | |
| parent | Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.2-20210827' in... (diff) | |
| download | qemu-13b250b12ad3c59114a6a17d59caf073ce45b33a.tar.gz qemu-13b250b12ad3c59114a6a17d59caf073ce45b33a.tar.xz qemu-13b250b12ad3c59114a6a17d59caf073ce45b33a.zip | |
uas: add stream number sanity checks.
The device uses the guest-supplied stream number unchecked, which can
lead to guest-triggered out-of-band access to the UASDevice->data3 and
UASDevice->status3 fields. Add the missing checks.
Fixes: CVE-2021-3713
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reported-by: Chen Zhe <chenzhe@huawei.com>
Reported-by: Tan Jingguo <tanjingguo@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210818120505.1258262-2-kraxel@redhat.com>
Diffstat (limited to 'hw/arm/stm32vldiscovery.c')
0 files changed, 0 insertions, 0 deletions