Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:GA
xen.4507
CVE-2016-3710-qemut-0001-vga-fix-banked-access-...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2016-3710-qemut-0001-vga-fix-banked-access-bounds-checking.patch of Package xen.4507
References: bsc#978164 CVE-2016-3710 XSA-179 From bebb4f580901fb638016d9851a28dbb83d44b3a6 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann <kraxel@redhat.com> Date: Tue, 26 Apr 2016 08:49:10 +0200 Subject: [PATCH 1/5] vga: fix banked access bounds checking (CVE-2016-3710) vga allows banked access to video memory using the window at 0xa00000 and it supports a different access modes with different address calculations. The VBE bochs extentions support banked access too, using the VBE_DISPI_INDEX_BANK register. The code tries to take the different address calculations into account and applies different limits to VBE_DISPI_INDEX_BANK depending on the current access mode. Which is probably effective in stopping misprogramming by accident. But from a security point of view completely useless as an attacker can easily change access modes after setting the bank register. Drop the bogus check, add range checks to vga_mem_{readb,writeb} instead. Fixes: CVE-2016-3710 Reported-by: Qinghao Tang <luodalongde@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> [Backport to qemu-xen-tradition] Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> --- hw/vga.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) Index: xen-4.4.4-testing/tools/qemu-xen-traditional-dir-remote/hw/vga.c =================================================================== --- xen-4.4.4-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/vga.c +++ xen-4.4.4-testing/tools/qemu-xen-traditional-dir-remote/hw/vga.c @@ -34,6 +34,8 @@ #include "qemu-timer.h" +#include <assert.h> + //#define DEBUG_VGA //#define DEBUG_VGA_MEM //#define DEBUG_VGA_REG @@ -684,11 +686,7 @@ static void vbe_ioport_write_data(void * vbe_fixup_regs(s); break; case VBE_DISPI_INDEX_BANK: - if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) { - val &= (s->vbe_bank_mask >> 2); - } else { - val &= s->vbe_bank_mask; - } + val &= s->vbe_bank_mask; s->vbe_regs[s->vbe_index] = val; s->bank_offset = (val << 16); break; @@ -787,13 +785,21 @@ uint32_t vga_mem_readb(void *opaque, tar if (s->sr[4] & 0x08) { /* chain 4 mode : simplest access */ + assert(addr < s->vram_size); ret = s->vram_ptr[addr]; } else if (s->gr[5] & 0x10) { /* odd/even mode (aka text mode mapping) */ plane = (s->gr[4] & 2) | (addr & 1); - ret = s->vram_ptr[((addr & ~1) << 1) | plane]; + addr = ((addr & ~1) << 1) | plane; + if (addr >= s->vram_size) { + return 0xff; + } + ret = s->vram_ptr[addr]; } else { /* standard VGA latched access */ + if (addr * sizeof(uint32_t) >= s->vram_size) { + return 0xff; + } s->latch = ((uint32_t *)s->vram_ptr)[addr]; if (!(s->gr[5] & 0x08)) { @@ -880,6 +886,7 @@ void vga_mem_writeb(void *opaque, target plane = addr & 3; mask = (1 << plane); if (s->sr[2] & mask) { + assert(addr < s->vram_size); s->vram_ptr[addr] = val; #ifdef DEBUG_VGA_MEM printf("vga: chain4: [0x%x]\n", addr); @@ -893,6 +900,9 @@ void vga_mem_writeb(void *opaque, target mask = (1 << plane); if (s->sr[2] & mask) { addr = ((addr & ~1) << 1) | plane; + if (addr >= s->vram_size) { + return; + } s->vram_ptr[addr] = val; #ifdef DEBUG_VGA_MEM printf("vga: odd/even: [0x%x]\n", addr); @@ -965,6 +975,9 @@ void vga_mem_writeb(void *opaque, target mask = s->sr[2]; s->plane_updated |= mask; /* only used to detect font change */ write_mask = mask16[mask]; + if (addr * sizeof(uint32_t) >= s->vram_size) { + return; + } ((uint32_t *)s->vram_ptr)[addr] = (((uint32_t *)s->vram_ptr)[addr] & ~write_mask) | (val & write_mask);
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor