Page MenuHomeFreeBSD

bhyve: Fix a buffer overread in the PCI hda device model.
ClosedPublic

Authored by jhb on Jan 19 2023, 10:40 PM.
Tags
None
Referenced Files
F102654321: D38128.diff
Fri, Nov 15, 9:56 AM
Unknown Object (File)
Tue, Oct 29, 11:18 AM
Unknown Object (File)
Sep 26 2024, 6:27 AM
Unknown Object (File)
Sep 26 2024, 6:27 AM
Unknown Object (File)
Sep 26 2024, 6:26 AM
Unknown Object (File)
Sep 25 2024, 12:47 PM
Unknown Object (File)
Sep 17 2024, 5:39 AM
Unknown Object (File)
Sep 4 2024, 9:44 AM
Subscribers

Details

Summary

The sc->codecs array contains HDA_CODEC_MAX (15) entries. The
guest-supplied cad field in the verb provided to hda_send_command is a
4-bit field that was used as an index into sc->codecs without any
bounds checking. The highest value (15) would overflow the array.

Other uses of sc->codecs in the device model used sc->codecs_no to
determine which array indices have been initialized, so use a similar
check to reject requests for uninitialized or invalid cad indices in
hda_send_command.

PR: 264582
Reported by: Robert Morris <rtm@lcs.mit.edu>
Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable