WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-09 11:17:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Layers: Fix intel bug introduced in commit 73d4f2f

Browse Source 
The patch failed to mask the incoming address to the maximum physical
address.  This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.

Fixes #1374.

Thanks to @the-rectifier for quickly identifying the issue!
This commit is contained in:
Mike Auty
2024-12-03 19:58:23 +00:00
parent e4c552050c
commit 3ff304ceed
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility3/framework/layers/intel.py
+1 -1
View File
@@ -182,7 +182,7 @@ class Intel(linear.LinearlyMappedLayer):
def _pte_pfn(self, entry: int) -> int:
"""Extracts the page frame number (PFN) from the page table entry (PTE) entry"""
return entry >> self.page_shift
return self._mask(entry, self._maxphyaddr - 1, 0) >> self.page_shift
def _translate_entry(self, offset: int) -> Tuple[int, int]:
"""Translates a specific offset based on paging tables.