]> git.proxmox.com Git - mirror_qemu.git/commit
hw/nvme: fix oob memory read in fdp events log
authorKlaus Jensen <k.jensen@samsung.com>
Thu, 3 Aug 2023 18:44:23 +0000 (20:44 +0200)
committerKlaus Jensen <k.jensen@samsung.com>
Mon, 7 Aug 2023 06:51:37 +0000 (08:51 +0200)
commitecb1b7b082d3b7dceff0e486a114502fc52c0fdf
tree0e5b330cfee52ea9e4ef8877931657cbd06c4c8a
parent9400601a689a128c25fa9c21e932562e0eeb7a26
hw/nvme: fix oob memory read in fdp events log

As reported by Trend Micro's Zero Day Initiative, an oob memory read
vulnerability exists in nvme_fdp_events(). The host-provided offset is
not verified.

Fix this.

This is only exploitable when Flexible Data Placement mode (fdp=on) is
enabled.

Fixes: CVE-2023-4135
Fixes: 73064edfb864 ("hw/nvme: flexible data placement emulation")
Reported-by: Trend Micro's Zero Day Initiative
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
hw/nvme/ctrl.c