Please sign in to comment.
KVM: Improve create VCPU parameter (CVE-2013-4587)
In multiple functions the vcpu_id is used as an offset into a bitfield. Ag malicious user could specify a vcpu_id greater than 255 in order to set or clear bits in kernel memory. This could be used to elevate priveges in the kernel. This patch verifies that the vcpu_id provided is less than 255. The api documentation already specifies that the vcpu_id must be less than max_vcpus, but this is currently not checked. Reported-by: Andrew Honig <firstname.lastname@example.org> Cc: email@example.com Signed-off-by: Andrew Honig <firstname.lastname@example.org> Signed-off-by: Paolo Bonzini <email@example.com>
- Loading branch information...