From 3ff304ceed2501df6d9291259f9bc6b3c587c303 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 3 Dec 2024 19:58:19 +0000 Subject: [PATCH] Layers: Fix intel bug introduced in commit 73d4f2f The patch failed to mask the incoming address to the maximum physical address. This allowed non-canonical addresses (potentially within the page table) to be looked up incorrectly. Fixes #1374. Thanks to @the-rectifier for quickly identifying the issue! --- volatility3/framework/layers/intel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index d762b41a8..c30ae48a8 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -182,7 +182,7 @@ class Intel(linear.LinearlyMappedLayer): def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number (PFN) from the page table entry (PTE) entry""" - return entry >> self.page_shift + return self._mask(entry, self._maxphyaddr - 1, 0) >> self.page_shift def _translate_entry(self, offset: int) -> Tuple[int, int]: """Translates a specific offset based on paging tables.