[Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()

[Petr Matousek]

Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit-channels with invalid index.

Fix this by ignoring read from the Mode/Command register.

This is CVE-2015-3214.

Signed-off-by: Petr Matousek pmato...@redhat.com
Reported-by: Matt Tait mattt...@google.com
---
 hw/timer/i8254.c | 6 ++
 1 file changed, 6 insertions(+)

diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 3450c98..9b65a33 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
 PITChannelState *s;
 
 addr = 3;
+
+if (addr == 3) {
+/* Mode/Command register is write only, read is ignored */
+return 0;
+}
+
 s = pit-channels[addr];
 if (s-status_latched) {
 s-status_latched = 0;
-- 
2.1.0

Re: [Qemu-devel] [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()

[Paolo Bonzini]

On 17/06/2015 12:46, Petr Matousek wrote:
 Due converting PIO to the new memory read/write api we no longer provide
 separate I/O region lenghts for read and write operations. As a result,
 reading from PIT Mode/Command register will end with accessing
 pit-channels with invalid index.
 
 Fix this by ignoring read from the Mode/Command register.
 
 This is CVE-2015-3214.
 
 Signed-off-by: Petr Matousek pmato...@redhat.com
 Reported-by: Matt Tait mattt...@google.com

Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052

Applied, thanks.

Paolo

 ---
  hw/timer/i8254.c | 6 ++
  1 file changed, 6 insertions(+)
 
 diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
 index 3450c98..9b65a33 100644
 --- a/hw/timer/i8254.c
 +++ b/hw/timer/i8254.c
 @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr 
 addr,
  PITChannelState *s;
  
  addr = 3;
 +
 +if (addr == 3) {
 +/* Mode/Command register is write only, read is ignored */
 +return 0;
 +}
 +
  s = pit-channels[addr];
  if (s-status_latched) {
  s-status_latched = 0;