linux/virt/kvm
Andy Honig 338c7dbadd KVM: Improve create VCPU parameter (CVE-2013-4587)
In multiple functions the vcpu_id is used as an offset into a bitfield.  Ag
malicious user could specify a vcpu_id greater than 255 in order to set or
clear bits in kernel memory.  This could be used to elevate priveges in the
kernel.  This patch verifies that the vcpu_id provided is less than 255.
The api documentation already specifies that the vcpu_id must be less than
max_vcpus, but this is currently not checked.

Reported-by: Andrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-12-12 22:39:33 +01:00
..
arm ARM: KVM: Bugfix: vgic_bytemap_get_reg per cpu regs 2013-08-30 16:12:38 +03:00
Kconfig kvm: Add VFIO device 2013-10-30 19:02:03 +01:00
assigned-dev.c
async_pf.c KVM: Drop FOLL_GET in GUP when doing async page fault 2013-10-15 13:43:37 +03:00
async_pf.h
coalesced_mmio.c
coalesced_mmio.h
eventfd.c kvm eventfd: switch to fdget 2013-09-03 23:04:45 -04:00
ioapic.c
ioapic.h
iodev.h
iommu.c KVM: IOMMU: hva align mapping page size 2013-11-05 09:55:36 +02:00
irq_comm.c KVM: Fix RTC interrupt coalescing tracking 2013-06-27 14:20:53 +03:00
irqchip.c
kvm_main.c KVM: Improve create VCPU parameter (CVE-2013-4587) 2013-12-12 22:39:33 +01:00
vfio.c kvm: Create non-coherent DMA registeration 2013-10-30 19:02:23 +01:00