qemu/hw/ide
Kevin Wolf d2ff858545 ide: Check array bounds before writing to io_buffer (CVE-2015-5154)
If the end_transfer_func of a command is called because enough data has
been read or written for the current PIO transfer, and it fails to
correctly call the command completion functions, the DRQ bit in the
status register and s->end_transfer_func may remain set. This allows the
guest to access further bytes in s->io_buffer beyond s->data_end, and
eventually overflowing the io_buffer.

One case where this currently happens is emulation of the ATAPI command
START STOP UNIT.

This patch fixes the problem by adding explicit array bounds checks
before accessing the buffer instead of relying on end_transfer_func to
function correctly.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
2015-07-26 23:42:53 -04:00
..
ahci.c ahci: Force ICC bits in PxCMD to zero 2015-07-20 12:21:18 -04:00
ahci.h ahci: Fix CD-ROM signature 2015-07-08 14:07:47 -04:00
atapi.c ide: commonize io_buffer_index initialization 2015-03-10 14:02:22 +01:00
cmd646.c Block patches for 2.3 2015-03-10 14:01:22 +00:00
core.c ide: Check array bounds before writing to io_buffer (CVE-2015-5154) 2015-07-26 23:42:53 -04:00
ich.c ich9/ahci: Enable Migration 2015-05-22 15:58:22 -04:00
internal.h ahci: add rwerror=stop support for ncq 2015-07-04 02:06:04 -04:00
isa.c ide: support PIO restart for the ISA controller 2015-03-10 14:02:23 +01:00
macio.c ide: add limit to .prepare_buf() 2015-07-04 02:06:04 -04:00
Makefile.objs hw: make all of hw/ide/ configurable via default-configs/ 2013-04-08 18:13:12 +02:00
microdrive.c hmp: Remove "info pcmcia" 2014-10-24 12:19:11 +01:00
mmio.c hw: Convert from BlockDriverState to BlockBackend, mostly 2014-10-20 14:02:25 +02:00
pci.c ide: add limit to .prepare_buf() 2015-07-04 02:06:04 -04:00
pci.h ide: place initial state of the current request to IDEBus 2015-03-10 14:02:22 +01:00
piix.c Block patches for 2.3 2015-03-10 14:01:22 +00:00
qdev.c BlockConf: Call backend functions to detect geometry and blocksizes 2015-03-10 14:02:22 +01:00
via.c Block patches for 2.3 2015-03-10 14:01:22 +00:00