Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Buffer Overflow Vulnerabilities in ACRN hypervisor & Device Model #1252

Closed
yonghuah opened this issue Sep 17, 2018 · 2 comments
Closed

Buffer Overflow Vulnerabilities in ACRN hypervisor & Device Model #1252

yonghuah opened this issue Sep 17, 2018 · 2 comments
Labels
priority: medium status: closed The issue been closed type: feature New feature
Projects
Roadmap
Milestone
v0.8

Comments

@yonghuah
Copy link
Contributor

During code analysis, a buffer overflow condition was detected that could reach out of bounds for the index of the array object in
the function. Many such instances were found to be present in the source code for the ACRN kernel and the hypervisor.
binbinwu1 added a commit to binbinwu1/acrn-hypervisor that referenced this issue Sep 17, 2018
@binbinwu1
hv: vtd: fix potential buffer overflow in suspend/resume
52f4c6b 
In current code of suspend_iommu/resume_iommu, there is potential buffer overflow
according to the code.
This patch put the buffer to struct dmar_drhd_rt, so that no need to access the buffer
via index.

Signed-off-by: Binbin Wu <binbin.wu@intel.com>
Tracked-On: projectacrn#1252
Acked-by: Eddie Dong <eddie.dong@intel.com>
@binbinwu1 binbinwu1 mentioned this issue Sep 17, 2018
Merged
@mwang106 mwang106 added type: feature New feature priority: medium status: new The issue status: new for creation labels Sep 17, 2018
@mwang106
Copy link
Contributor

mwang106 commented Sep 17, 2018 •
edited by Mingyuan18

[External_System_ID] ACRN-2145

binbinwu1 added a commit to binbinwu1/acrn-hypervisor that referenced this issue Sep 17, 2018
@binbinwu1
hv: vtd: fix potential buffer overflow in suspend/resume
7800a99 
In current code of suspend_iommu/resume_iommu, there is potential buffer overflow
according to the code.
This patch put the buffer to struct dmar_drhd_rt, so that no need to access the buffer
via index.

Signed-off-by: Binbin Wu <binbin.wu@intel.com>
Tracked-On: projectacrn#1252
Acked-by: Eddie Dong <eddie.dong@intel.com>
binbinwu1 added a commit to binbinwu1/acrn-hypervisor that referenced this issue Sep 17, 2018
@binbinwu1
hv: vtd: fix potential buffer overflow in suspend/resume
b9518d6 
In current code of suspend_iommu/resume_iommu, there is potential buffer overflow
according to the code.
This patch put the buffer to struct dmar_drhd_rt, so that no need to access the buffer
via index.

Signed-off-by: Binbin Wu <binbin.wu@intel.com>
Tracked-On: projectacrn#1252
Acked-by: Eddie Dong <eddie.dong@intel.com>
binbinwu1 added a commit to binbinwu1/acrn-hypervisor that referenced this issue Sep 17, 2018
@binbinwu1
hv: vtd: fix potential buffer overflow in suspend/resume
d674736 
In current code of suspend_iommu/resume_iommu, there is potential buffer overflow
according to the code.
This patch put the buffer to struct dmar_drhd_rt, so that no need to access the buffer
via index.

Signed-off-by: Binbin Wu <binbin.wu@intel.com>
Tracked-On: projectacrn#1252
Acked-by: Eddie Dong <eddie.dong@intel.com>
lijinxia pushed a commit that referenced this issue Sep 18, 2018
@binbinwu1 @lijinxia
hv: vtd: fix potential buffer overflow in suspend/resume
5329ced 
In current code of suspend_iommu/resume_iommu, there is potential buffer overflow
according to the code.
This patch put the buffer to struct dmar_drhd_rt, so that no need to access the buffer
via index.

Signed-off-by: Binbin Wu <binbin.wu@intel.com>
Tracked-On: #1252
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Sep 18, 2018
@yonghuah
HV:fix potential buffer overflow issues
1359cdd 
 - use sizeof(struct lapic_regs),instead of arbitrary size
   to lear 'apic_page' memory region in vlapic.c
 - fix potential buffer overflow issues in vpic.c & ioapic.c

Tracked-ON: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@yonghuah yonghuah mentioned this issue Sep 18, 2018
Merged
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Sep 18, 2018
@yonghuah
HV:fix potential buffer overflow issues
6a78d1b 
 - use sizeof(struct lapic_regs),instead of arbitrary size
   to lear 'apic_page' memory region in vlapic.c
 - fix potential buffer overflow issues in vpic.c & ioapic.c

Tracked-ON: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Sep 18, 2018
@yonghuah
HV:fix potential buffer overflow issues
4b36f51 
 - use sizeof(struct lapic_regs),instead of arbitrary size
   to lear 'apic_page' memory region in vlapic.c
 - fix potential buffer overflow issues in vpic.c & ioapic.c

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
lijinxia pushed a commit that referenced this issue Sep 18, 2018
@yonghuah @lijinxia
HV:fix potential buffer overflow issues
994a375 
 - use sizeof(struct lapic_regs),instead of arbitrary size
   to lear 'apic_page' memory region in vlapic.c
 - fix potential buffer overflow issues in vpic.c & ioapic.c

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@hwang37 hwang37 added this to v0.8 in Roadmap Oct 10, 2018
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Oct 23, 2018
@yonghuah
hv: fix problemtic logic in create_vcpu()
1e3c4d7 
 "hw.create_vcpus++" should be after resource is
 enough to create one more vcpu.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@yonghuah yonghuah mentioned this issue Oct 23, 2018
Closed
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Oct 23, 2018
@yonghuah
hv: fix problemtic logic in create_vcpu()
ff0a492 
 "hw.create_vcpus++" should be under the
 condition that resource is enough to create
 one more vcpu.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Oct 26, 2018
@yonghuah
dm: fix possible buffer overflow in 'acrn_load_elf()'
0291eaa 
  Will attempt to access element 2048..2049 of
  array "ptr32" if below conditions are both true:
  1) ptr32[i] == MULTIBOOT_HEAD_MAGIC
  2) (i == (ELF_BUF_LEN/4) - 1)

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Fengwei Yin <fengwei.yin@intel.com>
@yonghuah yonghuah mentioned this issue Oct 26, 2018
Merged
NanlinXie pushed a commit that referenced this issue Oct 27, 2018
@yonghuah @NanlinXie
dm: fix possible buffer overflow in 'acrn_load_elf()'
8860af3 
  Will attempt to access element 2048..2049 of
  array "ptr32" if below conditions are both true:
  1) ptr32[i] == MULTIBOOT_HEAD_MAGIC
  2) (i == (ELF_BUF_LEN/4) - 1)

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Fengwei Yin <fengwei.yin@intel.com>
@hwang37 hwang37 added this to the v0.8 milestone Nov 16, 2018
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 13, 2018
@yonghuah
hv: fix possible buffer overflow issues
2d68650 
 - cpu_secondary_init() @cpu.c
 - ptirq_intx_pin_remap() @ assign.c
   etc.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@yonghuah yonghuah mentioned this issue Dec 13, 2018
Merged
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 14, 2018
@yonghuah
hv: fix possible buffer overflow issues
462ba63 
 - cpu_secondary_init() @cpu.c
 - ptirq_intx_pin_remap() @ assign.c
   etc.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 14, 2018
@yonghuah
hv: fix possible buffer overflow issues
cb94e36 
 - cpu_secondary_init() @cpu.c
 - ptirq_intx_pin_remap() @ assign.c
   etc.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 14, 2018
@yonghuah
hv: fix possible buffer overflow issues
3c8d8e5 
 - cpu_secondary_init() @cpu.c
 - ptirq_intx_pin_remap() @ assign.c
   etc.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 14, 2018
@yonghuah
hv: fix possible buffer overflow issues
ce5f57c 
 - cpu_secondary_init() @cpu.c
 - ptirq_intx_pin_remap() @ assign.c
   etc.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
wenlingz pushed a commit that referenced this issue Dec 14, 2018
@yonghuah @wenlingz
hv: fix possible buffer overflow issues
57bf26d 
 - cpu_secondary_init() @cpu.c
 - ptirq_intx_pin_remap() @ assign.c
   etc.

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 18, 2018
@yonghuah
hv:fix possible buffer overflow in 'ptirq_get_intr_data()'
784820c 
 - 'buffer'with size of 'buffer_cnt',  will overflow in
    next loop if 'index == buffer_cnt - 1'.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@yonghuah yonghuah mentioned this issue Dec 18, 2018
Merged
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Dec 18, 2018
@yonghuah
hv:fix possible buffer overflow in 'ptirq_get_intr_data()'
2d2cae9 
 - 'buffer'with size of 'buffer_cnt',  will overflow in
    next loop if 'index == buffer_cnt - 1'.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
wenlingz pushed a commit that referenced this issue Dec 18, 2018
@yonghuah @wenlingz
hv:fix possible buffer overflow in 'ptirq_get_intr_data()'
b8ffac8 
 - 'buffer'with size of 'buffer_cnt',  will overflow in
    next loop if 'index == buffer_cnt - 1'.

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@tianhuas tianhuas mentioned this issue Dec 21, 2018
Merged
wenlingz pushed a commit that referenced this issue Dec 24, 2018
@yonghuah @wenlingz
hv:fix possible buffer overflow in 'ptirq_get_intr_data()'
c4f20c1 
 - 'buffer'with size of 'buffer_cnt',  will overflow in
    next loop if 'index == buffer_cnt - 1'.

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
This was referenced Jan 3, 2019
Closed
Merged
Merged
wenlingz pushed a commit that referenced this issue Jan 3, 2019
@tianhuas @wenlingz
DM: xHCI: array bound checking before it is used
01c8f54 
Array index of "vbdp_devs" may be out of bounds if
"i >= XHCI_MAX_VIRT_PORTS", so index checking is necessary.

Tracked-On: #1252
Signed-off-by: Tianhua Sun <tianhuax.s.sun@intel.com>
Acked-by: Yu Wang <yu1.wang@intel.com>
wenlingz pushed a commit that referenced this issue Jan 4, 2019
@tianhuas @wenlingz
DM: xHCI: array bound checking before it is used
633ede7 
Array index of "vbdp_devs" may be out of bounds if
"i >= XHCI_MAX_VIRT_PORTS", so index checking is necessary.

Tracked-On: #1252
Signed-off-by: Tianhua Sun <tianhuax.s.sun@intel.com>
Acked-by: Yu Wang <yu1.wang@intel.com>
@mwang106
Copy link
Contributor

No regression issue

@mwang106 mwang106 added status: closed The issue been closed and removed status: new The issue status: new for creation labels Jan 11, 2019
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Jan 25, 2019
@yonghuah
hv: fix possible buffer overflow in 'vcpu_set_eoi_exit()'
e4dd9d9 
 'vector' should be no greater than 0xff,else
 'eoi_exit_bitmap[]' will overflow.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@yonghuah yonghuah mentioned this issue Jan 25, 2019
Merged
wenlingz pushed a commit that referenced this issue Jan 25, 2019
@yonghuah @wenlingz
hv: fix possible buffer overflow in 'vcpu_set_eoi_exit()'
ee066a7 
 'vector' should be no greater than 0xff,else
 'eoi_exit_bitmap[]' will overflow.

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
yonghuah added a commit to yonghuah/acrn-hypervisor that referenced this issue Apr 23, 2019
@yonghuah
hv: fix possible buffer overflow in vlapic.c
2a65bfe 
  Possible buffer overflow will happen in vlapic_set_tmr()
  and vlapic_update_ppr(),this path is to fix them.

Tracked-On: projectacrn#1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
@yonghuah yonghuah mentioned this issue Apr 23, 2019
Merged
wenlingz pushed a commit that referenced this issue Apr 23, 2019
@yonghuah @wenlingz
hv: fix possible buffer overflow in vlapic.c
f991d17 
  Possible buffer overflow will happen in vlapic_set_tmr()
  and vlapic_update_ppr(),this path is to fix them.

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
wenlingz pushed a commit that referenced this issue Apr 23, 2019
@yonghuah @wenlingz
hv: fix possible buffer overflow in vlapic.c
7bcfebc 
  Possible buffer overflow will happen in vlapic_set_tmr()
  and vlapic_update_ppr(),this path is to fix them.

Tracked-On: #1252
Signed-off-by: Yonghua Huang <yonghua.huang@intel.com>
Acked-by: Eddie Dong <eddie.dong@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
priority: medium status: closed The issue been closed type: feature New feature
Projects
Roadmap
  
v0.5
Milestone
v0.8
Development

No branches or pull requests
3 participants
@mwang106 @hwang37 @yonghuah