File CVE-2016-6833-qemuu-net-vmxnet3-use-after-free-... of Package xen.3265

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-6833-qemuu-net-vmxnet3-use-after-free-while-writing.patch of Package xen.3265

References: bsc#994775 CVE-2016-6833

Vmxnet3 device emulator does not check if the device is active,
before using it for write. It leads to a use after free issue,
if the vmxnet3_io_bar0_write routine is called after the device is
deactivated. Add check to avoid it.

Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Acked-by: Dmitry Fleytman <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
 hw/net/vmxnet3.c | 4 ++++
 1 file changed, 4 insertions(+)

Index: xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
===================================================================
--- xen-4.4.4-testing.orig/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
+++ xen-4.4.4-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
@@ -1071,6 +1071,10 @@ vmxnet3_io_bar0_write(void *opaque, hwad
 {
     VMXNET3State *s = opaque;
 
+    if (!s->device_active) {
+        return;
+    }
+
     if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD,
                         VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) {
         int tx_queue_idx =

Places

File CVE-2016-6833-qemuu-net-vmxnet3-use-after-free-while-writing.patch of Package xen.3265

Places