XSA-239

Advisory: XSA-239

The IOAPIC REG_SELECT register is an 8bit register, which is expected to be accessed with 32bit accesses.

Before XSA-239, the emulated IOAPIC code read 32 bits passed to it, even though only 8 bits had been initialised. The upper 24 bits of stack rubble is then retrievable via a 32bit read of the REG_SELECT register.

See also

tests/xsa-239/main.c