diff options
| author | Pierre Pronchery <pierre@freebsdfoundation.org> | 2024-07-19 17:32:27 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2024-10-04 00:22:34 +0000 |
| commit | 64b0f52be2c9d7bcecebfeef393f8ec56cb85f47 (patch) | |
| tree | 60cb5a02c853264bd77de1f1e5baf4ab112793df /sys/dev/evdev | |
| parent | 593d7a1634b5536f0ce2935305c3a5d1d6dd56bd (diff) | |
ctl: limit memory allocation in pci_virtio_scsi
The virtio_scsi device allows a VM guest to directly send SCSI commands
(ctsio->cdb array) to the kernel driver exposed on /dev/cam/ctl
(ctl.ko).
All kernel commands accessible from the guest are defined by
ctl_cmd_table.
The command ctl_persistent_reserve_out (cdb[0]=0x5F and cbd[1]=0) allows
the caller to call malloc() with an arbitrary size (uint32_t). This can
be used by the guest to overload the kernel memory (DOS attack).
Reported by: Synacktiv
Reviewed by: asomers
Security: HYP-08
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46044
Diffstat (limited to 'sys/dev/evdev')
0 files changed, 0 insertions, 0 deletions