[Xen-changelog] [qemu-xen-traditional stable-4.6] vga: fix banked access bounds checking (CVE-2016-3710)

[patchbot@xxxxxxx]

commit 93fd3a22466ecd7e4c5486e1d39b454598bf3af9
Author:     Gerd Hoffmann <kraxel@xxxxxxxxxx>
AuthorDate: Tue Apr 26 08:49:10 2016 +0200
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Tue May 10 18:57:47 2016 +0100

    vga: fix banked access bounds checking (CVE-2016-3710)
    
    vga allows banked access to video memory using the window at 0xa00000
    and it supports a different access modes with different address
    calculations.
    
    The VBE bochs extentions support banked access too, using the
    VBE_DISPI_INDEX_BANK register.  The code tries to take the different
    address calculations into account and applies different limits to
    VBE_DISPI_INDEX_BANK depending on the current access mode.
    
    Which is probably effective in stopping misprogramming by accident.
    But from a security point of view completely useless as an attacker
    can easily change access modes after setting the bank register.
    
    Drop the bogus check, add range checks to vga_mem_{readb,writeb}
    instead.
    
    Fixes: CVE-2016-3710
    Reported-by: Qinghao Tang <luodalongde@xxxxxxxxx>
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
    [Backport to qemu-xen-tradition]
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 hw/vga.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/hw/vga.c b/hw/vga.c
index e8b1ce0..72256f1 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -34,6 +34,8 @@
 
 #include "qemu-timer.h"
 
+#include <assert.h>
+
 //#define DEBUG_VGA
 //#define DEBUG_VGA_MEM
 //#define DEBUG_VGA_REG
@@ -684,11 +686,7 @@ static void vbe_ioport_write_data(void *opaque, uint32_t 
addr, uint32_t val)
             vbe_fixup_regs(s);
             break;
         case VBE_DISPI_INDEX_BANK:
-            if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) {
-              val &= (s->vbe_bank_mask >> 2);
-            } else {
-              val &= s->vbe_bank_mask;
-            }
+            val &= s->vbe_bank_mask;
             s->vbe_regs[s->vbe_index] = val;
             s->bank_offset = (val << 16);
             break;
@@ -787,13 +785,21 @@ uint32_t vga_mem_readb(void *opaque, target_phys_addr_t 
addr)
 
     if (s->sr[4] & 0x08) {
         /* chain 4 mode : simplest access */
+        assert(addr < s->vram_size);
         ret = s->vram_ptr[addr];
     } else if (s->gr[5] & 0x10) {
         /* odd/even mode (aka text mode mapping) */
         plane = (s->gr[4] & 2) | (addr & 1);
-        ret = s->vram_ptr[((addr & ~1) << 1) | plane];
+        addr = ((addr & ~1) << 1) | plane;
+        if (addr >= s->vram_size) {
+            return 0xff;
+        }
+        ret = s->vram_ptr[addr];
     } else {
         /* standard VGA latched access */
+        if (addr * sizeof(uint32_t) >= s->vram_size) {
+            return 0xff;
+        }
         s->latch = ((uint32_t *)s->vram_ptr)[addr];
 
         if (!(s->gr[5] & 0x08)) {
@@ -880,6 +886,7 @@ void vga_mem_writeb(void *opaque, target_phys_addr_t addr, 
uint32_t val)
         plane = addr & 3;
         mask = (1 << plane);
         if (s->sr[2] & mask) {
+            assert(addr < s->vram_size);
             s->vram_ptr[addr] = val;
 #ifdef DEBUG_VGA_MEM
             printf("vga: chain4: [0x%x]\n", addr);
@@ -893,6 +900,9 @@ void vga_mem_writeb(void *opaque, target_phys_addr_t addr, 
uint32_t val)
         mask = (1 << plane);
         if (s->sr[2] & mask) {
             addr = ((addr & ~1) << 1) | plane;
+            if (addr >= s->vram_size) {
+                return;
+            }
             s->vram_ptr[addr] = val;
 #ifdef DEBUG_VGA_MEM
             printf("vga: odd/even: [0x%x]\n", addr);
@@ -965,6 +975,9 @@ void vga_mem_writeb(void *opaque, target_phys_addr_t addr, 
uint32_t val)
         mask = s->sr[2];
         s->plane_updated |= mask; /* only used to detect font change */
         write_mask = mask16[mask];
+        if (addr * sizeof(uint32_t) >= s->vram_size) {
+            return;
+        }
         ((uint32_t *)s->vram_ptr)[addr] =
             (((uint32_t *)s->vram_ptr)[addr] & ~write_mask) |
             (val & write_mask);
--
generated by git-patchbot for /home/xen/git/qemu-xen-traditional.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog