QEMU tulip DMA-reentrancy overflow (CVE-2022-2962)

Aynı bug/CVE: bkz. canonical QEMU Tulip device DMA reentrancy. Tulip descriptor/buffer pointer'larının device'ın kendi MMIO'suna alias'lanması → tulip_write() self re-entry → host stack overflow (CVE-2022-2962).

Mechanism

Tek bir tulip DMA-reentrancy bug'ı (hw/net/tulip.c); mekanizma kanonik not'ta tam olarak ele alınır: QEMU Tulip device DMA reentrancy.

Walkthrough

Tam walkthrough canonical not'ta: QEMU Tulip device DMA reentrancy.

References

• GitLab issue #1171 — tulip DMA reentrancy
• GitLab commit 36a894ae — Restrict DMA engine to memories