From: Andrew Cooper Date: Fri, 5 Mar 2021 14:31:50 +0000 (+0100) Subject: x86/ucode/amd: Fix OoB read in cpu_request_microcode() X-Git-Tag: archive/raspbian/4.14.2+25-gb6a8c4f72d-2+rpi1^2~47^2~61 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=daa4149647e1ba5ea22de346e1894ae793a17500;p=xen.git x86/ucode/amd: Fix OoB read in cpu_request_microcode() verify_patch_size() is a maximum size check, and doesn't have a minimum bound. If the microcode container encodes a blob with a length less than 64 bytes, the subsequent calls to microcode_fits()/compare_header() may read off the end of the buffer. Fixes: 4de936a38a ("x86/ucode/amd: Rework parsing logic in cpu_request_microcode()") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich master commit: 1cbc4d89c45cba3929f1c0cb4bca0b000c4f174b master date: 2021-02-10 13:23:51 +0000 --- diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/amd.c index cd532321e8..5b45530d93 100644 --- a/xen/arch/x86/cpu/microcode/amd.c +++ b/xen/arch/x86/cpu/microcode/amd.c @@ -346,6 +346,7 @@ static struct microcode_patch *cpu_request_microcode(const void *buf, size_t siz if ( size < sizeof(*mc) || (mc = buf)->type != UCODE_UCODE_TYPE || size - sizeof(*mc) < mc->len || + mc->len < sizeof(struct microcode_patch) || (!skip_ucode && !verify_patch_size(mc->len)) ) { printk(XENLOG_ERR "microcode: Bad microcode data\n");