Skip to content

Commit

Permalink
Layers: Fix intel bug introduced in commit 73d4f2f
Browse files Browse the repository at this point in the history
The patch failed to mask the incoming address to the maximum physical
address.  This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.

Fixes #1374.

Thanks to @the-rectifier for quickly identifying the issue!
  • Loading branch information
ikelos committed Dec 3, 2024
1 parent e4c5520 commit 3ff304c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion volatility3/framework/layers/intel.py
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ def _translate(self, offset: int) -> Tuple[int, int, str]:

def _pte_pfn(self, entry: int) -> int:
"""Extracts the page frame number (PFN) from the page table entry (PTE) entry"""
return entry >> self.page_shift
return self._mask(entry, self._maxphyaddr - 1, 0) >> self.page_shift

def _translate_entry(self, offset: int) -> Tuple[int, int]:
"""Translates a specific offset based on paging tables.
Expand Down

0 comments on commit 3ff304c

Please sign in to comment.