upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-12 02:00:31 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

bhyve/nvme: Fix out-of-bounds read in NVMe log page

Browse source 
The function nvme_opc_get_log_page in the file usr.sbin/bhyve/pci_nvme.c
is vulnerable to buffer over-read. The value logoff is user controlled
but never checked against the value of logsize. Thus the difference:
	logsize - logoff
can underflow.

Due to the sc structure layout, an attacker can dump internals fields of
sc and the content of next heap allocation.

Reported by: Synacktiv
Reviewed by:	emaste, jhb
Security: HYP-07
Sponsored by: Alpha-Omega Project, The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D46021

(cherry picked from commit b0a24be007)
This commit is contained in:
Chuck Tuffli 2024-09-19 08:11:30 -07:00 committed by Ed Maste
parent 2f29060f46
commit a5be19efbb
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
usr.sbin/bhyve/pci_nvme.c
View file

@ -1398,7 +1398,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command,
logsize *= sizeof(uint32_t);
logoff = ((uint64_t)(command->cdw13) << 32) | command->cdw12;
DPRINTF("%s log page %u len %u", __func__, logpage, logsize);
DPRINTF("%s log page %u offset %lu len %u", __func__, logpage, logoff, logsize);
switch (logpage) {
case NVME_LOG_ERROR:
@ -1410,7 +1410,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command,
nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1,
command->prp2, (uint8_t *)&sc->err_log + logoff,
MIN(logsize - logoff, sizeof(sc->err_log)),
MIN(logsize, sizeof(sc->err_log) - logoff),
NVME_COPY_TO_PRP);
break;
case NVME_LOG_HEALTH_INFORMATION:
@ -1433,7 +1433,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command,
nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1,
command->prp2, (uint8_t *)&sc->health_log + logoff,
MIN(logsize - logoff, sizeof(sc->health_log)),
MIN(logsize, sizeof(sc->health_log) - logoff),
NVME_COPY_TO_PRP);
break;
case NVME_LOG_FIRMWARE_SLOT:
@ -1445,7 +1445,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command,
nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1,
command->prp2, (uint8_t *)&sc->fw_log + logoff,
MIN(logsize - logoff, sizeof(sc->fw_log)),
MIN(logsize, sizeof(sc->fw_log) - logoff),
NVME_COPY_TO_PRP);
break;
case NVME_LOG_CHANGED_NAMESPACE:
@ -1457,7 +1457,7 @@ nvme_opc_get_log_page(struct pci_nvme_softc* sc, struct nvme_command* command,
nvme_prp_memcpy(sc->nsc_pi->pi_vmctx, command->prp1,
command->prp2, (uint8_t *)&sc->ns_log + logoff,
MIN(logsize - logoff, sizeof(sc->ns_log)),
MIN(logsize, sizeof(sc->ns_log) - logoff),
NVME_COPY_TO_PRP);
memset(&sc->ns_log, 0, sizeof(sc->ns_log));
break;