diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2020-06-04 14:38:30 +0530 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-06-05 09:14:40 +0200 |
| commit | a98610c429d52db0937c1e48659428929835c455 (patch) | |
| tree | a161aed3e9c0d0163faa5413db74f6f5ac7b60aa /hw/sd/sdhci-internal.h | |
| parent | 66234fee9c2d37bfbc523aa8d0ae5300a14cc10e (diff) | |
ati-vga: check mm_index before recursive call (CVE-2020-13800)
While accessing VGA registers via ati_mm_read/write routines,
a guest may set 's->regs.mm_index' such that it leads to infinite
recursion. Check mm_index value to avoid such recursion. Log an
error message for wrong values.
Reported-by: Ren Ding <rding@gatech.edu>
Reported-by: Hanqing Zhao <hanqing@gatech.edu>
Reported-by: Yi Ren <c4tren@gmail.com>
Message-id: 20200604090830.33885-1-ppandit@redhat.com
Suggested-by: BALATON Zoltan <balaton@eik.bme.hu>
Suggested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/sd/sdhci-internal.h')
0 files changed, 0 insertions, 0 deletions