[Bug 264435] bhyve: hda_write() can index (and jump) beyond end of array

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 26 Jan 2023 22:36:07 UTC

--- Comment #3 from commit-hook@FreeBSD.org ---
A commit in branch stable/13 references this bug:


commit f31dc54deed4bfc2779a991758033c36a9bf6fd1
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2023-01-20 17:57:45 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2023-01-26 22:28:56 +0000

    bhyve: Fix a global buffer overread in the PCI hda device model.

    hda_write did not validate the relative register offset before using
    it as an index into the hda_set_reg_table array to lookup a function
    pointer to execute after updating the register's value.

    PR:             264435
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Reviewed by:    corvink, markj, emaste
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D38127

    (cherry picked from commit bfe8e339eb77910c2eb739b45aaa936148b33897)

 usr.sbin/bhyve/pci_hda.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

You are receiving this mail because:
You are on the CC list for the bug.