diff options
| author | Prasad J Pandit | 2020-06-04 11:08:30 +0200 |
|---|---|---|
| committer | Gerd Hoffmann | 2020-06-05 09:14:40 +0200 |
| commit | a98610c429d52db0937c1e48659428929835c455 (patch) | |
| tree | a161aed3e9c0d0163faa5413db74f6f5ac7b60aa /include/exec/user | |
| parent | Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20200... (diff) | |
| download | qemu-a98610c429d52db0937c1e48659428929835c455.tar.gz qemu-a98610c429d52db0937c1e48659428929835c455.tar.xz qemu-a98610c429d52db0937c1e48659428929835c455.zip | |
ati-vga: check mm_index before recursive call (CVE-2020-13800)
While accessing VGA registers via ati_mm_read/write routines,
a guest may set 's->regs.mm_index' such that it leads to infinite
recursion. Check mm_index value to avoid such recursion. Log an
error message for wrong values.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Yi Ren <c4tren@gmail.com>
Message-id: 20200604090830.33885-1-ppandit@redhat.com
Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'include/exec/user')
0 files changed, 0 insertions, 0 deletions