[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH0z3hMh6Txh5Bi_JTLTkxxsfGrZyNmvB1d1h6aCSZHkBj0O7A@mail.gmail.com>
Date: Thu, 27 Oct 2016 00:41:28 +0200
From: Vlad Tsyrklevich <vlad@...rklevich.net>
To: oss-security@...ts.openwall.com
Subject: kernel: low-severity vfio driver integer overflow
The vfio driver allows direct user access to devices. The
VFIO_DEVICE_SET_IRQS ioctl for vfio PCI devices has a state machine
confusion bug where specifying VFIO_IRQ_SET_DATA_NONE along with
another bit in VFIO_IRQ_SET_DATA_TYPE_MASK in hdr.flags allows integer
overflow checks to be skipped for hdr.start/hdr.count. This might
allow memory corruption later in vfio_pci_set_msi_trigger() with user
access to an appropriate vfio device file, but it seems difficult to
usefully exploit in practice.
https://patchwork.kernel.org/patch/9373631/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
