x86/microcode/intel: Handle truncated microcode images more robustly

Browse source

We do not check the input data bounds containing the microcode before
copying a struct microcode_intel_header from it. A specially crafted
microcode could cause the kernel to read invalid memory and lead to a
denial-of-service.

Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Link: http://lkml.kernel.org/r/1422964824-22056-3-git-send-email-quentin.casasnovas@oracle.com
[ Made error message differ from the next one and flipped comparison. ]
Signed-off-by: Borislav Petkov <bp@suse.de>

...

This commit is contained in:

Quentin Casasnovas 2015-02-03 13:00:24 +01:00 • committed by Borislav Petkov

parent f84598bd7c

commit 35a9ff4eec

2 changed files with 9 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

arch/x86/kernel/cpu/microcode/intel.c

View file

4

arch/x86/kernel/cpu/microcode/intel_early.c

View file