diff options
| author | David Woodhouse <dwmw@amazon.co.uk> | 2023-07-25 12:05:00 +0200 |
|---|---|---|
| committer | Philippe Mathieu-Daudé <philmd@linaro.org> | 2023-08-01 23:52:23 +0200 |
| commit | 75a87af9b228ca7d14902a9390fe5e83c4898eb0 (patch) | |
| tree | 9c32705683936eb76605928a8b1e7121a3cf4605 /scripts | |
| parent | 19c417ec87a446ffd1a13eeec23226fe30f31b7e (diff) | |
| download | qemu-75a87af9b228ca7d14902a9390fe5e83c4898eb0.zip qemu-75a87af9b228ca7d14902a9390fe5e83c4898eb0.tar.gz qemu-75a87af9b228ca7d14902a9390fe5e83c4898eb0.tar.bz2 | |
hw/xen: prevent guest from binding loopback event channel to itself
Fuzzing showed that a guest could bind an interdomain port to itself, by
guessing the next port to be allocated and putting that as the 'remote'
port number. By chance, that works because the newly-allocated port has
type EVTCHNSTAT_unbound. It shouldn't.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230801175747.145906-4-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions