diff options
| author | Chuck Tuffli <chuck@FreeBSD.org> | 2024-09-19 15:11:30 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2024-10-11 15:42:40 +0000 |
| commit | c8f75686adc6bc2078ade279d838cbc5b1745e71 (patch) | |
| tree | d3ef3a5054080a461ce089fbe748defb2d10a4f9 /lib/libdevstat | |
| parent | 72e277f41aa5c31068c7f9c7e237d2926450a1d8 (diff) | |
bhyve/nvme: Fix out-of-bounds read in NVMe log page
The function nvme_opc_get_log_page in the file usr.sbin/bhyve/pci_nvme.c
is vulnerable to buffer over-read. The value logoff is user controlled
but never checked against the value of logsize. Thus the difference:
logsize - logoff
can underflow.
Due to the sc structure layout, an attacker can dump internals fields of
sc and the content of next heap allocation.
Reported by: Synacktiv
Reviewed by: emaste, jhb
Security: HYP-07
Sponsored by: Alpha-Omega Project, The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46021
(cherry picked from commit b0a24be007d83f7929de5b3fc320a29e6868067d)
(cherry picked from commit a5be19efbb7c6b07d574ef048b2ebade00440873)
Diffstat (limited to 'lib/libdevstat')
0 files changed, 0 insertions, 0 deletions