diff options
| author | Chuck Tuffli <chuck@FreeBSD.org> | 2024-09-19 15:11:30 +0000 |
|---|---|---|
| committer | Chuck Tuffli <chuck@FreeBSD.org> | 2024-10-06 13:50:28 +0000 |
| commit | b0a24be007d83f7929de5b3fc320a29e6868067d (patch) | |
| tree | 0bd225fcf2085ef60a1823da0c683db13438764b | |
| parent | 7d893fce0d1126959733efec7105b56d0de7a3cb (diff) | |
| download | src-b0a24be007d83f7929de5b3fc320a29e6868067d.tar.gz src-b0a24be007d83f7929de5b3fc320a29e6868067d.zip | |
bhyve/nvme: Fix out-of-bounds read in NVMe log page
The function nvme_opc_get_log_page in the file usr.sbin/bhyve/pci_nvme.c
is vulnerable to buffer over-read. The value logoff is user controlled
but never checked against the value of logsize. Thus the difference:
logsize - logoff
can underflow.
Due to the sc structure layout, an attacker can dump internals fields of
sc and the content of next heap allocation.
Reported by: Synacktiv
Reviewed by: emaste, jhb
Security: HYP-07
Sponsored by: Alpha-Omega Project, The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46021
| -rw-r--r-- | usr.sbin/bhyve/pci_nvme.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/usr.sbin/bhyve/pci_nvme.c b/usr.sbin/bhyve/pci_nvme.c index 45ab1b11fda4..b8eb24d91b49 100644 --- a/usr.sbin/bhyve/pci_nvme.c +++ b/usr.sbin/bhyve/pci_nvme.c @@ -1398,7 +1398,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command, logsize *= sizeof(uint32_t); logoff = ((uint64_t)(command->cdw13) << 32) | command->cdw12; - DPRINTF("%s log page %u len %u", __func__, logpage, logsize); + DPRINTF("%s log page %u offset %lu len %u", __func__, logpage, logoff, logsize); switch (logpage) { case NVME_LOG_ERROR: @@ -1410,7 +1410,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command, nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1, command->prp2, (uint8_t *)&sc->err_log + logoff, - MIN(logsize - logoff, sizeof(sc->err_log)), + MIN(logsize, sizeof(sc->err_log) - logoff), NVME_COPY_TO_PRP); break; case NVME_LOG_HEALTH_INFORMATION: @@ -1433,7 +1433,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command, nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1, command->prp2, (uint8_t *)&sc->health_log + logoff, - MIN(logsize - logoff, sizeof(sc->health_log)), + MIN(logsize, sizeof(sc->health_log) - logoff), NVME_COPY_TO_PRP); break; case NVME_LOG_FIRMWARE_SLOT: @@ -1445,7 +1445,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command, nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1, command->prp2, (uint8_t *)&sc->fw_log + logoff, - MIN(logsize - logoff, sizeof(sc->fw_log)), + MIN(logsize, sizeof(sc->fw_log) - logoff), NVME_COPY_TO_PRP); break; case NVME_LOG_CHANGED_NAMESPACE: @@ -1457,7 +1457,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command, nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1, command->prp2, (uint8_t *)&sc->ns_log + logoff, - MIN(logsize - logoff, sizeof(sc->ns_log)), + MIN(logsize, sizeof(sc->ns_log) - logoff), NVME_COPY_TO_PRP); memset(&sc->ns_log, 0, sizeof(sc->ns_log)); break; |