[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 0/5] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CV
From: |
Bin Meng |
Subject: |
[PATCH v3 0/5] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409 |
Date: |
Wed, 3 Mar 2021 18:41:23 +0800 |
This series includes several fixes to CVE-2020-17380, CVE-2020-25085
and CVE-2021-3409 that are heap-based buffer overflow issues existing
in the sdhci model.
These CVEs are pretty much similar, and were filed using different
reproducers. With this series, current known reproducers I have
cannot be reproduced any more.
The implementation of this model still has some issues, e.g.: some codes
do not seem to strictly match the spec, but since this series only aimes
to address CVEs, such issue should be fixed in a separate series in the
future, if I have time :)
Changes in v3:
- Embed the reproducer in the commit message
Changes in v2:
- new patch: sdhci: Limit block size only when SDHC_BLKSIZE register is writable
- new patch: sdhci: Reset the data pointer of s->fifo_buffer[] when a different
block size is programmed
Bin Meng (5):
hw/sd: sdhci: Don't transfer any data when command time out
hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in
progress
hw/sd: sdhci: Correctly set the controller status for ADMA
hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is
writable
hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a
different block size is programmed
hw/sd/sdhci.c | 53 ++++++++++++++++++++++++++++++++++++-----------------
1 file changed, 36 insertions(+), 17 deletions(-)
--
2.7.4
- [PATCH v3 0/5] hw/sd: sdhci: Fixes to CVE-2020-17380, CVE-2020-25085, CVE-2021-3409,
Bin Meng <=
- [PATCH v3 1/5] hw/sd: sdhci: Don't transfer any data when command time out, Bin Meng, 2021/03/03
- [PATCH v3 2/5] hw/sd: sdhci: Don't write to SDHC_SYSAD register when transfer is in progress, Bin Meng, 2021/03/03
- [PATCH v3 3/5] hw/sd: sdhci: Correctly set the controller status for ADMA, Bin Meng, 2021/03/03
- [PATCH v3 4/5] hw/sd: sdhci: Limit block size only when SDHC_BLKSIZE register is writable, Bin Meng, 2021/03/03
- [PATCH v3 5/5] hw/sd: sdhci: Reset the data pointer of s->fifo_buffer[] when a different block size is programmed, Bin Meng, 2021/03/03