Skip to content

Commit 3ff304c

Browse files
committed
Layers: Fix intel bug introduced in commit 73d4f2f
The patch failed to mask the incoming address to the maximum physical address. This allowed non-canonical addresses (potentially within the page table) to be looked up incorrectly. Fixes #1374. Thanks to @the-rectifier for quickly identifying the issue!
1 parent e4c5520 commit 3ff304c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

volatility3/framework/layers/intel.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ def _translate(self, offset: int) -> Tuple[int, int, str]:
182182

183183
def _pte_pfn(self, entry: int) -> int:
184184
"""Extracts the page frame number (PFN) from the page table entry (PTE) entry"""
185-
return entry >> self.page_shift
185+
return self._mask(entry, self._maxphyaddr - 1, 0) >> self.page_shift
186186

187187
def _translate_entry(self, offset: int) -> Tuple[int, int]:
188188
"""Translates a specific offset based on paging tables.

0 commit comments

Comments
 (0)