mirror of
https://github.com/qemu/qemu.git
synced 2025-10-31 04:06:46 +00:00
1ab95af033
Guest might select another drive on the bus by setting the DRIVE_SEL bit of the DIGITAL OUTPUT REGISTER (DOR). The current controller model doesn't expect a BlockBackend to be NULL. A simple way to fix CVE-2021-20196 is to create an empty BlockBackend when it is missing. All further accesses will be safely handled, and the controller state machines keep behaving correctly. Cc: qemu-stable@nongnu.org Fixes: CVE-2021-20196 Reported-by: Gaoning Pan (Ant Security Light-Year Lab) <pgn@zju.edu.cn> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20211124161536.631563-3-philmd@redhat.com BugLink: https://bugs.launchpad.net/qemu/+bug/1912780 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/338 Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: John Snow <jsnow@redhat.com> |
||
|---|---|---|
| .. | ||
| dataplane | ||
| block.c | ||
| cdrom.c | ||
| ecc.c | ||
| fdc-internal.h | ||
| fdc-isa.c | ||
| fdc-sysbus.c | ||
| fdc.c | ||
| hd-geometry.c | ||
| Kconfig | ||
| m25p80.c | ||
| meson.build | ||
| nand.c | ||
| onenand.c | ||
| pflash_cfi01.c | ||
| pflash_cfi02.c | ||
| swim.c | ||
| tc58128.c | ||
| trace-events | ||
| trace.h | ||
| vhost-user-blk.c | ||
| virtio-blk.c | ||
| xen_blkif.h | ||
| xen-block.c | ||