]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
vmci: prevent speculation leaks by sanitizing event in event_deliver()
authorHagar Gamal Halim Hemdan <hagarhem@amazon.com>
Tue, 30 Apr 2024 08:59:16 +0000 (08:59 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 May 2024 05:28:53 +0000 (07:28 +0200)
commit8003f00d895310d409b2bf9ef907c56b42a4e0f4
tree5c02070102d4937d992cf6fb98a7f0e1356c5b1a
parent35230d31056d82a416bba881cceca420fc90d079
vmci: prevent speculation leaks by sanitizing event in event_deliver()

Coverity spotted that event_msg is controlled by user-space,
event_msg->event_data.event is passed to event_deliver() and used
as an index without sanitization.

This change ensures that the event index is sanitized to mitigate any
possibility of speculative information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Only compile tested, no access to HW.

Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
Cc: stable <stable@kernel.org>
Signed-off-by: Hagar Gamal Halim Hemdan <hagarhem@amazon.com>
Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com
Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/vmw_vmci/vmci_event.c