** Patch added:
"0001-fw_cfg-Disallow-writes-to-non-writable-firmware-entr.patch"
https://bugs.launchpad.net/bugs/786211/+attachment/2137594/+files/0001-fw_cfg-Disallow-writes-to-non-writable-firmware-entr.patch
** Visibility changed to: Public
--
You received this bug notification because
*** This bug is a security vulnerability ***
Public security bug reported:
When the DRQ_STAT bit is set, the IDE core permits both data reads and
data writes, regardless of whether the current transfer was initiated as
a read or write.
Furthermore, the IO buffer is allocated via a qemu_memalign
Public bug reported:
Several calls in the ide_exec_cmd handler are missing checks for
(!s->bs) or similar, resulting in NULL pointer dereferences, divide-by-
zero, or possibly other badness if the guest performs operations on a
non-existent IDE master.
For example, the WIN_READ_NATIVE_MAX command
