diff options
author | Andy Honig <ahonig@google.com> | 2013-11-18 16:09:22 -0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-12-20 07:45:07 -0800 |
commit | f4d838225e0cbdc8099c2eb8d55dd9406def1f33 (patch) | |
tree | ce82eab11ef8913393eeb58b66e528d2480e78cb /drivers/scsi/aha1740.h | |
parent | a5633d4871bae973f39945b2ba0f86f6bbd45ab4 (diff) |
KVM: Improve create VCPU parameter (CVE-2013-4587)
commit 338c7dbadd2671189cec7faf64c84d01071b3f96 upstream.
In multiple functions the vcpu_id is used as an offset into a bitfield. Ag
malicious user could specify a vcpu_id greater than 255 in order to set or
clear bits in kernel memory. This could be used to elevate priveges in the
kernel. This patch verifies that the vcpu_id provided is less than 255.
The api documentation already specifies that the vcpu_id must be less than
max_vcpus, but this is currently not checked.
Reported-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/scsi/aha1740.h')
0 files changed, 0 insertions, 0 deletions