338c7dbadd
In multiple functions the vcpu_id is used as an offset into a bitfield. Ag malicious user could specify a vcpu_id greater than 255 in order to set or clear bits in kernel memory. This could be used to elevate priveges in the kernel. This patch verifies that the vcpu_id provided is less than 255. The api documentation already specifies that the vcpu_id must be less than max_vcpus, but this is currently not checked. Reported-by: Andrew Honig <ahonig@google.com> Cc: stable@vger.kernel.org Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|---|---|---|
| .. | ||
| arm | ||
| assigned-dev.c | ||
| async_pf.c | ||
| async_pf.h | ||
| coalesced_mmio.c | ||
| coalesced_mmio.h | ||
| eventfd.c | ||
| ioapic.c | ||
| ioapic.h | ||
| iodev.h | ||
| iommu.c | ||
| irq_comm.c | ||
| irqchip.c | ||
| Kconfig | ||
| kvm_main.c | ||
| vfio.c | ||