Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Oct 2016 00:41:28 +0200
From: Vlad Tsyrklevich <vlad@...rklevich.net>
To: oss-security@...ts.openwall.com
Subject: kernel: low-severity vfio driver integer overflow

The vfio driver allows direct user access to devices. The
VFIO_DEVICE_SET_IRQS ioctl for vfio PCI devices has a state machine
confusion bug where specifying VFIO_IRQ_SET_DATA_NONE along with
another bit in VFIO_IRQ_SET_DATA_TYPE_MASK in hdr.flags allows integer
overflow checks to be skipped for hdr.start/hdr.count. This might
allow memory corruption later in vfio_pci_set_msi_trigger() with user
access to an appropriate vfio device file, but it seems difficult to
usefully exploit in practice.

https://patchwork.kernel.org/patch/9373631/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.