google / google/android-emulator-hypervisor-driver
Memory corruption bug in IOCTL handler
Open
- Dominant language
- C
- Stars
- 887
- Forks
- 263
- PR merge metrics
- No merged PRs in 30d
Description
Inside of kvm_main.c there is a [case which is unsafe](https://github.com/google/android-emulator-hypervisor-driver/blob/84d47bedf13301d7ed73a8e46ca2576a96f3c64e/virt/kvm/kvm_main.c#L2079).
The bug is that RtlCopyBytes will unconditionally attempt to read 32 bytes from the system buffer (which is not guaranteed to be at least 32 bytes) into a local kvm_userspace_memory_region structure.
This causes the system to bug check with SYSTEM_SERVICE_EXCEPTION.
One potential fix for this is using aehdCopyInputBuffer and checking the result.
Contributor guide
Assessment
This issue has not been assessed yet.