Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
i8254: fix out-of-bounds memory access in pit_ioport_read()
Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.

Fix this by ignoring read from the Mode/Command register.

This is CVE-2015-3214.

Reported-by: Matt Tait <matttait@google.com>
Fixes: 0505bcd
Cc: qemu-stable@nongnu.org
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  • Loading branch information
pmatouse authored and bonzini committed Jun 17, 2015
1 parent 9dacf32 commit d4862a8
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions hw/timer/i8254.c
Expand Up @@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
PITChannelState *s;

addr &= 3;

if (addr == 3) {
/* Mode/Command register is write only, read is ignored */
return 0;
}

s = &pit->channels[addr];
if (s->status_latched) {
s->status_latched = 0;
Expand Down

0 comments on commit d4862a8

Please sign in to comment.