diff options
| author | Chuck Tuffli <chuck@FreeBSD.org> | 2024-09-19 15:11:30 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2024-10-11 15:34:27 +0000 |
| commit | a5be19efbb7c6b07d574ef048b2ebade00440873 (patch) | |
| tree | 8b96d8093d5961ac63a5d4ef6a61abb454d463a8 /tests/atf_python | |
| parent | 2f29060f46138bbfc52c5944825293d598cc68de (diff) | |
bhyve/nvme: Fix out-of-bounds read in NVMe log page
The function nvme_opc_get_log_page in the file usr.sbin/bhyve/pci_nvme.c
is vulnerable to buffer over-read. The value logoff is user controlled
but never checked against the value of logsize. Thus the difference:
logsize - logoff
can underflow.
Due to the sc structure layout, an attacker can dump internals fields of
sc and the content of next heap allocation.
Reported by: Synacktiv
Reviewed by: emaste, jhb
Security: HYP-07
Sponsored by: Alpha-Omega Project, The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46021
(cherry picked from commit b0a24be007d83f7929de5b3fc320a29e6868067d)
Diffstat (limited to 'tests/atf_python')
0 files changed, 0 insertions, 0 deletions