Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
xen.14764
5e7dfbf6-x86-ucode-AMD-potential-buffer-overrun...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 5e7dfbf6-x86-ucode-AMD-potential-buffer-overrun-equiv-tab.patch of Package xen.14764
# Commit 1f97b6b9f1b5978659c5735954c37c130e7bb151 # Date 2020-03-27 13:13:26 +0000 # Author Andrew Cooper <andrew.cooper3@citrix.com> # Committer Andrew Cooper <andrew.cooper3@citrix.com> x86/ucode/amd: Fix potential buffer overrun with equiv table handling find_equiv_cpu_id() loops until it finds a 0 installed_cpu entry. Well formed AMD microcode containers have this property. Extend the checking in install_equiv_cpu_table() to reject tables which don't have a sentinal at the end. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> --- a/xen/arch/x86/microcode_amd.c +++ b/xen/arch/x86/microcode_amd.c @@ -297,6 +297,7 @@ static int install_equiv_cpu_table( size_t *offset) { const struct mpbhdr *mpbuf = data + *offset + 4; + const struct equiv_cpu_entry *eq; *offset += mpbuf->len + CONT_HDR_SIZE; /* add header length */ @@ -306,7 +307,9 @@ static int install_equiv_cpu_table( return -EINVAL; } - if ( mpbuf->len == 0 ) + if ( mpbuf->len == 0 || mpbuf->len % sizeof(*eq) || + (eq = (const void *)mpbuf->data, + eq[(mpbuf->len / sizeof(*eq)) - 1].installed_cpu) ) { printk(KERN_ERR "microcode: Wrong microcode equivalent cpu table length\n"); return -EINVAL;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor