HomeFreeBSD

bhyve: avoid buffer overflow in pci_vtcon_control_send

Description

bhyve: avoid buffer overflow in pci_vtcon_control_send

The program copies an input buffer to an output buffer without verifying
that the size of the input buffer is less than the size of the output
buffer, leading to a buffer overflow.

Inside the function pci_vtcon_control_send, the length of the iov buffer
is not validated before copy of the payload.

Reported by: Synacktiv
Reviewed by: markj
Security: HYP-19
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46105

Details

Provenance
khorben_defora.orgAuthored on Jul 24 2024, 6:23 PM
emasteCommitted on Sep 30 2024, 12:01 PM
Reviewer
markj
Differential Revision
Restricted Differential Revision
Parents
rG8e3d252901e8: pf: Split pf_map_addr()
Branches
Unknown
Tags
Unknown