TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Tale of two hypervisor bugs – Escaping from FreeBSD bhyve

102 pointsby 2510c39011c5about 5 years ago

5 comments

saagarjhaabout 5 years ago
&gt; The below patch fixed the issue:<p><pre><code> struct { uint8_t dac_state; - int dac_rd_index; - int dac_rd_subindex; - int dac_wr_index; - int dac_wr_subindex; + uint8_t dac_rd_index; + uint8_t dac_rd_subindex; + uint8_t dac_wr_index; + uint8_t dac_wr_subindex; uint8_t dac_palette[3 * 256]; uint32_t dac_palette_rgb[256]; } vga_dac; </code></pre> &gt; The VGA device emulation in bhyve uses 32-bit signed integer as DAC Address Write Mode Register and DAC Address Read Mode Register. These registers are used to access the palette RAM, having 256 entries of intensities for each value of red, green and blue. Data in palette RAM can be read or written by accessing DAC Data Register.<p>&gt; After three successful I&#x2F;O access to red, green and blue intensity values, DAC Address Write Mode Register or DAC Address Read Mode Register is incremented automatically based on the operation performed. Here is the issue, the values of DAC Address Read Mode Register and DAC Address Write Mode Register does not wrap under index of 256 since the data type is not &#x27;uint8_t&#x27;, allowing an untrusted guest to read or write past the palette RAM into adjacent heap memory.<p>Ugh, this looks like an ugly patch :( How about not letting the index overflow in the first place?<p>&gt; Though FreeBSD does not have ASLR<p>Why not?!
评论 #22806801 未加载
评论 #22807682 未加载
评论 #22806367 未加载
bArrayabout 5 years ago
I really wish phrack.org had an RSS feed so I can keep on top of their latest papers.
评论 #22807900 未加载
takedaabout 5 years ago
Any reason why phrack talks about 2016 vulnerability 4 years later? I was thinking that once security advisory is published it is a fair game.
lloekiabout 5 years ago
Wondering if it directly or indirectly affects xhyve and Docker’s HyperKit.
评论 #22814518 未加载
monocasaabout 5 years ago
Interestingly this is the kind of thing Rust is great at protecting against, and why Firecracker is such a neat project.
评论 #22806618 未加载
评论 #22806582 未加载