ati-vga: check mm_index before recursive call (CVE-2020-13800)
While accessing VGA registers via ati_mm_read/write routines, a guest may set 's->regs.mm_index' such that it leads to infinite recursion. Check mm_index value to avoid such recursion. Log an error message for wrong values. Reported-by:Ren Ding <rding@gatech.edu> Reported-by:
Hanqing Zhao <hanqing@gatech.edu> Reported-by:
Yi Ren <c4tren@gmail.com> Message-id: 20200604090830.33885-1-ppandit@redhat.com Suggested-by:
BALATON Zoltan <balaton@eik.bme.hu> Suggested-by:
Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by:
Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
Loading
Please register or sign in to comment