From unknown Mon Aug 18 04:47:17 2025 X-Loop: help-debbugs@gnu.org Subject: bug#27221: [PATCH] gnu: qemu: Fix CVE-2017-{8112,8309,8379,8380}. Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sat, 03 Jun 2017 22:36:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 27221 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 27221@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.14965293398283 (code B ref -1); Sat, 03 Jun 2017 22:36:02 +0000 Received: (at submit) by debbugs.gnu.org; 3 Jun 2017 22:35:39 +0000 Received: from localhost ([127.0.0.1]:54304 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHHdr-00029N-Oz for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:39 -0400 Received: from eggs.gnu.org ([208.118.235.92]:57920) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHHdn-000296-Sz for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dHHdg-0004DD-Nk for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:22 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:40027) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dHHdg-0004D4-Km for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:20 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48890) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dHHde-0002AA-3P for guix-patches@gnu.org; Sat, 03 Jun 2017 18:35:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dHHda-00048C-JG for guix-patches@gnu.org; Sat, 03 Jun 2017 18:35:18 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:32943) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dHHda-000472-27 for guix-patches@gnu.org; Sat, 03 Jun 2017 18:35:14 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 22D01206D3; Sat, 3 Jun 2017 18:35:13 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Sat, 03 Jun 2017 18:35:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:message-id:subject:to:x-me-sender:x-me-sender :x-sasl-enc:x-sasl-enc; s=mesmtp; bh=qlkAQawEF41JRaXj3iFRipaPhmh y30eEQcRiSD/ocu8=; b=n9IzpWe7/g/FT9Uw1d/G8ByVPCfUtWuFNi6WMnn7wcu G6W4jDmeVBUtGuTRZ3nPdn5S+vVTSAEY9f919unUvQ5CTavd/o6eNGvV7+dC8LY5 foKPRqv7P92hGf6UBfz4Y0KWTy9JVTemU+XWNckXHX7XFqIDsaVJncqpRObwYENE = DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=qlkAQa wEF41JRaXj3iFRipaPhmhy30eEQcRiSD/ocu8=; b=rnKwfHsUgqt8Bry5p3gczw 9ewHUuggkragsqKXpI1Wot81Ixz/qZq16bw4Vlzy9HzDyiAB25dzzRiQ/E/cr56U ECrfvWoh15UVZCghdTBJOwycV9wuVPQUTDi12BpmrxCI+Vekv0QH27xdJTHlfdAw JjYJNMr4sauHnUFfR215DREjrm6NheDkE5ozPcVK7SLuSNdN96okCCwLJH9NQM19 7IdphMuhxEothtLxICP3ibJbeg96yLBk/Ur3UC6P33NNHGU5YwX3wI5wazNnsTD7 td27i0LFk+LwUTRZLqhKQBlVk9JpiEDcN6usX1EvBp3HC/excs+cXCjkp4DQK8tQ == X-ME-Sender: X-Sasl-enc: r4KP+enOHW8oVkTZ3qz8vAZ1dZh0RMGtAkm6xLrp1M7P 1496529312 Received: from localhost.localdomain (unknown [84.19.184.51]) by mail.messagingengine.com (Postfix) with ESMTPA id 4BDFB24753 for ; Sat, 3 Jun 2017 18:35:12 -0400 (EDT) From: Leo Famulari Date: Sat, 3 Jun 2017 18:35:04 -0400 Message-Id: <4591378184662a18cf89e307389896ab52ac9405.1496529304.git.leo@famulari.name> X-Mailer: git-send-email 2.13.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.9 (/) * gnu/packages/patches/qemu-CVE-2017-8112.patch, gnu/packages/patches/qemu-CVE-2017-8309.patch, gnu/packages/patches/qemu-CVE-2017-8379.patch, gnu/packages/patches/qemu-CVE-2017-8380.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/qemu.scm (qemu)[source]: Use them. --- gnu/local.mk | 4 ++ gnu/packages/patches/qemu-CVE-2017-8112.patch | 41 +++++++++++ gnu/packages/patches/qemu-CVE-2017-8309.patch | 46 +++++++++++++ gnu/packages/patches/qemu-CVE-2017-8379.patch | 98 +++++++++++++++++++++++++++ gnu/packages/patches/qemu-CVE-2017-8380.patch | 53 +++++++++++++++ gnu/packages/qemu.scm | 6 +- 6 files changed, 247 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/qemu-CVE-2017-8112.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-8309.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-8379.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-8380.patch diff --git a/gnu/local.mk b/gnu/local.mk index e7d5ee2f4..85bcbd632 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -953,6 +953,10 @@ dist_patch_DATA = \ %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch \ %D%/packages/patches/python2-subprocess32-disable-input-test.patch \ %D%/packages/patches/qemu-CVE-2017-7493.patch \ + %D%/packages/patches/qemu-CVE-2017-8112.patch \ + %D%/packages/patches/qemu-CVE-2017-8309.patch \ + %D%/packages/patches/qemu-CVE-2017-8379.patch \ + %D%/packages/patches/qemu-CVE-2017-8380.patch \ %D%/packages/patches/qt4-ldflags.patch \ %D%/packages/patches/qtscript-disable-tests.patch \ %D%/packages/patches/quickswitch-fix-dmenu-check.patch \ diff --git a/gnu/packages/patches/qemu-CVE-2017-8112.patch b/gnu/packages/patches/qemu-CVE-2017-8112.patch new file mode 100644 index 000000000..88b33aa2f --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8112.patch @@ -0,0 +1,41 @@ +Fix CVE-2017-8112: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8112 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=f68826989cd4d1217797251339579c57b3c0934e + +From f68826989cd4d1217797251339579c57b3c0934e Mon Sep 17 00:00:00 2001 +From: P J P +Date: Tue, 25 Apr 2017 18:36:23 +0530 +Subject: [PATCH] vmw_pvscsi: check message ring page count at initialisation + +A guest could set the message ring page count to zero, resulting in +infinite loop. Add check to avoid it. + +Reported-by: YY Z +Signed-off-by: P J P +Message-Id: <20170425130623.3649-1-ppandit@redhat.com> +Reviewed-by: Dmitry Fleytman +Signed-off-by: Paolo Bonzini +--- + hw/scsi/vmw_pvscsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c +index 75575461e2..4a106da856 100644 +--- a/hw/scsi/vmw_pvscsi.c ++++ b/hw/scsi/vmw_pvscsi.c +@@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri) + uint32_t len_log2; + uint32_t ring_size; + +- if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { ++ if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { + return -1; + } + ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE; +-- +2.13.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-8309.patch b/gnu/packages/patches/qemu-CVE-2017-8309.patch new file mode 100644 index 000000000..dc4b4006b --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8309.patch @@ -0,0 +1,46 @@ +Fix CVE-2017-8309: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8309 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=3268a845f41253fb55852a8429c32b50f36f349a + +From 3268a845f41253fb55852a8429c32b50f36f349a Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 28 Apr 2017 09:56:12 +0200 +Subject: [PATCH] audio: release capture buffers + +AUD_add_capture() allocates two buffers which are never released. +Add the missing calls to AUD_del_capture(). + +Impact: Allows vnc clients to exhaust host memory by repeatedly +starting and stopping audio capture. + +Fixes: CVE-2017-8309 +Cc: P J P +Cc: Huawei PSIRT +Reported-by: "Jiangxin (hunter, SCC)" +Signed-off-by: Gerd Hoffmann +Reviewed-by: Prasad J Pandit +Message-id: 20170428075612.9997-1-kraxel@redhat.com +--- + audio/audio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/audio/audio.c b/audio/audio.c +index c8898d8422..beafed209b 100644 +--- a/audio/audio.c ++++ b/audio/audio.c +@@ -2028,6 +2028,8 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque) + sw = sw1; + } + QLIST_REMOVE (cap, entries); ++ g_free (cap->hw.mix_buf); ++ g_free (cap->buf); + g_free (cap); + } + return; +-- +2.13.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-8379.patch b/gnu/packages/patches/qemu-CVE-2017-8379.patch new file mode 100644 index 000000000..200b133d3 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8379.patch @@ -0,0 +1,98 @@ +Fix CVE-2017-8379: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8379 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=fa18f36a461984eae50ab957e47ec78dae3c14fc + +From fa18f36a461984eae50ab957e47ec78dae3c14fc Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 28 Apr 2017 10:42:37 +0200 +Subject: [PATCH] input: limit kbd queue depth + +Apply a limit to the number of items we accept into the keyboard queue. + +Impact: Without this limit vnc clients can exhaust host memory by +sending keyboard events faster than qemu feeds them to the guest. + +Fixes: CVE-2017-8379 +Cc: P J P +Cc: Huawei PSIRT +Reported-by: jiangxin1@huawei.com +Signed-off-by: Gerd Hoffmann +Message-id: 20170428084237.23960-1-kraxel@redhat.com +--- + ui/input.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/ui/input.c b/ui/input.c +index ed88cda6d6..fb1f404095 100644 +--- a/ui/input.c ++++ b/ui/input.c +@@ -41,6 +41,8 @@ static QTAILQ_HEAD(QemuInputEventQueueHead, QemuInputEventQueue) kbd_queue = + QTAILQ_HEAD_INITIALIZER(kbd_queue); + static QEMUTimer *kbd_timer; + static uint32_t kbd_default_delay_ms = 10; ++static uint32_t queue_count; ++static uint32_t queue_limit = 1024; + + QemuInputHandlerState *qemu_input_handler_register(DeviceState *dev, + QemuInputHandler *handler) +@@ -268,6 +270,7 @@ static void qemu_input_queue_process(void *opaque) + break; + } + QTAILQ_REMOVE(queue, item, node); ++ queue_count--; + g_free(item); + } + } +@@ -282,6 +285,7 @@ static void qemu_input_queue_delay(struct QemuInputEventQueueHead *queue, + item->delay_ms = delay_ms; + item->timer = timer; + QTAILQ_INSERT_TAIL(queue, item, node); ++ queue_count++; + + if (start_timer) { + timer_mod(item->timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +@@ -298,6 +302,7 @@ static void qemu_input_queue_event(struct QemuInputEventQueueHead *queue, + item->src = src; + item->evt = evt; + QTAILQ_INSERT_TAIL(queue, item, node); ++ queue_count++; + } + + static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue) +@@ -306,6 +311,7 @@ static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue) + + item->type = QEMU_INPUT_QUEUE_SYNC; + QTAILQ_INSERT_TAIL(queue, item, node); ++ queue_count++; + } + + void qemu_input_event_send_impl(QemuConsole *src, InputEvent *evt) +@@ -381,7 +387,7 @@ void qemu_input_event_send_key(QemuConsole *src, KeyValue *key, bool down) + qemu_input_event_send(src, evt); + qemu_input_event_sync(); + qapi_free_InputEvent(evt); +- } else { ++ } else if (queue_count < queue_limit) { + qemu_input_queue_event(&kbd_queue, src, evt); + qemu_input_queue_sync(&kbd_queue); + } +@@ -409,8 +415,10 @@ void qemu_input_event_send_key_delay(uint32_t delay_ms) + kbd_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, qemu_input_queue_process, + &kbd_queue); + } +- qemu_input_queue_delay(&kbd_queue, kbd_timer, +- delay_ms ? delay_ms : kbd_default_delay_ms); ++ if (queue_count < queue_limit) { ++ qemu_input_queue_delay(&kbd_queue, kbd_timer, ++ delay_ms ? delay_ms : kbd_default_delay_ms); ++ } + } + + InputEvent *qemu_input_event_new_btn(InputButton btn, bool down) +-- +2.13.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-8380.patch b/gnu/packages/patches/qemu-CVE-2017-8380.patch new file mode 100644 index 000000000..65e49fc88 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8380.patch @@ -0,0 +1,53 @@ +Fix CVE-2017-8380: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8380 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f + +From 24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Mon, 24 Apr 2017 17:36:34 +0530 +Subject: [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write + +While reading magic sequence(MFI_SEQ) in megasas_mmio_write, +an off-by-one error could occur as 's->adp_reset' index is not +reset after reading the last sequence. + +Reported-by: YY Z +Signed-off-by: Prasad J Pandit +Message-Id: <20170424120634.12268-1-ppandit@redhat.com> +Signed-off-by: Paolo Bonzini +--- + hw/scsi/megasas.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c +index 84b8caf901..804122ab05 100644 +--- a/hw/scsi/megasas.c ++++ b/hw/scsi/megasas.c +@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr, + case MFI_SEQ: + trace_megasas_mmio_writel("MFI_SEQ", val); + /* Magic sequence to start ADP reset */ +- if (adp_reset_seq[s->adp_reset] == val) { +- s->adp_reset++; ++ if (adp_reset_seq[s->adp_reset++] == val) { ++ if (s->adp_reset == 6) { ++ s->adp_reset = 0; ++ s->diag = MFI_DIAG_WRITE_ENABLE; ++ } + } else { + s->adp_reset = 0; + s->diag = 0; + } +- if (s->adp_reset == 6) { +- s->diag = MFI_DIAG_WRITE_ENABLE; +- } + break; + case MFI_DIAG: + trace_megasas_mmio_writel("MFI_DIAG", val); +-- +2.13.0 + diff --git a/gnu/packages/qemu.scm b/gnu/packages/qemu.scm index 0734b6d0f..31354b25d 100644 --- a/gnu/packages/qemu.scm +++ b/gnu/packages/qemu.scm @@ -74,7 +74,11 @@ (method url-fetch) (uri (string-append "http://wiki.qemu-project.org/download/qemu-" version ".tar.xz")) - (patches (search-patches "qemu-CVE-2017-7493.patch")) + (patches (search-patches "qemu-CVE-2017-7493.patch" + "qemu-CVE-2017-8112.patch" + "qemu-CVE-2017-8309.patch" + "qemu-CVE-2017-8379.patch" + "qemu-CVE-2017-8380.patch")) (sha256 (base32 "08mhfs0ndbkyqgw7fjaa9vjxf4dinrly656f6hjzvmaz7hzc677h")))) -- 2.13.0 From unknown Mon Aug 18 04:47:17 2025 X-Loop: help-debbugs@gnu.org Subject: bug#27221: [PATCH] gnu: qemu: Fix CVE-2017-{8112, 8309, 8379, 8380}. Resent-From: Marius Bakke Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sat, 03 Jun 2017 23:52:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 27221 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Leo Famulari , 27221@debbugs.gnu.org Received: via spool by 27221-submit@debbugs.gnu.org id=B27221.149653386822884 (code B ref 27221); Sat, 03 Jun 2017 23:52:01 +0000 Received: (at 27221) by debbugs.gnu.org; 3 Jun 2017 23:51:08 +0000 Received: from localhost ([127.0.0.1]:54384 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHIp2-0005x2-0G for submit@debbugs.gnu.org; Sat, 03 Jun 2017 19:51:08 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:44371) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHIox-0005wq-5I for 27221@debbugs.gnu.org; Sat, 03 Jun 2017 19:51:06 -0400 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id E48B020B7A; Sat, 3 Jun 2017 19:51:02 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute5.internal (MEProxy); Sat, 03 Jun 2017 19:51:02 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=fm1; bh=DvZvu5aSbRrZmbeKrqLRpK3paPltk5YgI2g06aTlf mQ=; b=LbdkHaGwLVjhodU/MwrHksF2ocgLXcAFH6a0ja6wR+fMSxSCGusP6ogm+ UnbfOF3ltqmw04Y/+YVJMW4tP34erOSmr2erL35BfJMKWEPIbBqdomgAhHVFHfOk 7B9WNtQ4Gwi80Hz9zlXxNM2dQ0IADbefjdzKEePrKgVP2gRRFXR/x7bujVM+yDQS 4YUPBeMRpN6fC48YzIK7NL84O5q3NVmiG96c2Isb2LQDRi6ULvIEuS/tNqXWsVRn dyQJOVhZIcy5bZtZn4FZc9Bj/Kur+sQSF7x98+/Enox43S8uVC4N/NOhFwJNM3yU 3ui/v6ieWtk+rLULYHf6tPWF+nfRA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=DvZvu5aSbRrZmbeKrq LRpK3paPltk5YgI2g06aTlfmQ=; b=cQbR20LqMHdJd8eMjFbu+7b1H3F17NGeVx kiVjndmQl25MF/G/w+IavJzSmBoAvW+nNQrENEUREvUQmF5PZA30aYMoEo8WuH19 bD4Xc3UrCOM+iw4F/dOhqu1GNn+ed/Lm5ktZgB/NI0HpXh6V/p6wvnvn5HM9e3Za vukt3lG0pPThNYbUbAeHk2pGJ0i3xBjZuVTeKd3rODICBTn3yPEATWJMpIFfXMk4 5TDAIMWhJD4iRVj3HentQz0GXtxupsCsiXFx7/q+bLVRPTjTYH5I1aA4L8Yd6IFh pQa7ZvdePdaIQLAnDU/7OEp2KBbCqT02c53L3NFfkRwcGxIh1j+w== X-ME-Sender: X-Sasl-enc: 0WyBD0Ybw3Ihknr9hB4BE8jZoUoRL8QaHkB5iaGZUKsy 1496533862 Received: from localhost (unknown [188.113.81.93]) by mail.messagingengine.com (Postfix) with ESMTPA id 7C7C67E7AA; Sat, 3 Jun 2017 19:51:02 -0400 (EDT) From: Marius Bakke In-Reply-To: <4591378184662a18cf89e307389896ab52ac9405.1496529304.git.leo@famulari.name> References: <4591378184662a18cf89e307389896ab52ac9405.1496529304.git.leo@famulari.name> User-Agent: Notmuch/0.24.2 (https://notmuchmail.org) Emacs/25.2.1 (x86_64-unknown-linux-gnu) Date: Sun, 04 Jun 2017 01:51:00 +0200 Message-ID: <87vaoczl3v.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --=-=-= Content-Type: text/plain Leo Famulari writes: > * gnu/packages/patches/qemu-CVE-2017-8112.patch, > gnu/packages/patches/qemu-CVE-2017-8309.patch, > gnu/packages/patches/qemu-CVE-2017-8379.patch, > gnu/packages/patches/qemu-CVE-2017-8380.patch: New files. > * gnu/local.mk (dist_patch_DATA): Add them. > * gnu/packages/qemu.scm (qemu)[source]: Use them. LGTM. Thanks for keeping up with this. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlkzS2UACgkQoqBt8qM6 VPq/yQf+L8jo8sLoKLMeDubrQTPZpoB9p9w+cqbuUzAuXhu3lZdY+EO1VjFRv2xy oQsTdR66Hclz1Cm4VNTdWLQLsvKmpvLhAmqb7ut0zIZdaXlCSsSLywGiu08uOwry J8fI4KlA2s1gc0v6stgOFrpIemXuYa88t0pI4Ak62HhoJVmVbLGW6uCOWlLCXEit vNCwe6tlTmO1H7Sfc6Edl9Uut8KtWOEWkb8Bwgj0zRga7A4kZtpTCvBRZrDk6XGF djxrkpj6uz160vHC8RvmjJ9mG7+raFKLJCq5+GhX0voVoIgB7Fo/I6sGlt6PNHP1 QYEVI7NuMqDiY0jQ/S8SZg0NC2g9aA== =cONN -----END PGP SIGNATURE----- --=-=-=-- From unknown Mon Aug 18 04:47:17 2025 MIME-Version: 1.0 X-Mailer: MIME-tools 5.505 (Entity 5.505) X-Loop: help-debbugs@gnu.org From: help-debbugs@gnu.org (GNU bug Tracking System) To: Leo Famulari Subject: bug#27221: closed (Re: bug#27221: [PATCH] gnu: qemu: Fix CVE-2017-{8112, 8309, 8379, 8380}.) Message-ID: References: <20170604011238.GB30199@jasmine> <4591378184662a18cf89e307389896ab52ac9405.1496529304.git.leo@famulari.name> X-Gnu-PR-Message: they-closed 27221 X-Gnu-PR-Package: guix-patches X-Gnu-PR-Keywords: patch Reply-To: 27221@debbugs.gnu.org Date: Sun, 04 Jun 2017 01:13:02 +0000 Content-Type: multipart/mixed; boundary="----------=_1496538782-30759-1" This is a multi-part message in MIME format... ------------=_1496538782-30759-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your bug report #27221: [PATCH] gnu: qemu: Fix CVE-2017-{8112,8309,8379,8380}. which was filed against the guix-patches package, has been closed. The explanation is attached below, along with your original report. If you require more details, please reply to 27221@debbugs.gnu.org. --=20 27221: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D27221 GNU Bug Tracking System Contact help-debbugs@gnu.org with problems ------------=_1496538782-30759-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 27221-done) by debbugs.gnu.org; 4 Jun 2017 01:12:46 +0000 Received: from localhost ([127.0.0.1]:54407 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHK62-0007zd-6Q for submit@debbugs.gnu.org; Sat, 03 Jun 2017 21:12:46 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:59625) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHK5w-0007zP-BR for 27221-done@debbugs.gnu.org; Sat, 03 Jun 2017 21:12:44 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 85C7D20B05; Sat, 3 Jun 2017 21:12:39 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute4.internal (MEProxy); Sat, 03 Jun 2017 21:12:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=mesmtp; bh=cc1pikKebm6eSbQskECNZ3AJsgVUxIhBdN9/zc 5altI=; b=CkqywQfz7LqGXnQXiRYee08yxKATAv/upgVuJpRfUeorFV/uQFUB96 HHPyvAhCBE8t5H+noM+Uu7uhOGBaWmSIE5TB1Gr0vopEt/tcKn8GPp44nHBvV3Qx fekbj3to+vaJyFVLx17bIru7Qdd77E1fc3Ed7euleJgWus5rSFMeY= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=cc1pikKebm6eSbQskE CNZ3AJsgVUxIhBdN9/zc5altI=; b=LVBksfo9F3Y3P8aqW+Ux6u4MkW05s2GBkX 163s33el7tfp2jZ8DEL/LS0VLmMdKWt0eGNtx7EXk+UFnyuegCeCLOBLwKX9liHA rtUlhbKfF7o9LiYcagXT+g42AXUxMWtlAJOD1wFZog4cQ0/rhXSgWUfwudXYzvAu 22VpYYoRGEStAC0uPPutc507WVKr/5Vz2NlEGVHCaNfczdaIusXaIPN+0fRx4M0x R0EsYCRq20ZA59mBPOwgUrWDCxzAq0UVXcXJp/yzd+BpYUSEF/2oaxLVV/aZIXDG YqqHcrbo936qY3Ue8X3Jf+8YE+fHAE5hD7bnk6Y8jpgXvfQI934Q== X-ME-Sender: X-Sasl-enc: pQMnlOtsYvIvvxQOTIO+dKUQ02A0R5Jzrp3ufWZsN+mr 1496538759 Received: from localhost (unknown [73.81.113.118]) by mail.messagingengine.com (Postfix) with ESMTPA id 472507E51B; Sat, 3 Jun 2017 21:12:39 -0400 (EDT) Date: Sat, 3 Jun 2017 21:12:38 -0400 From: Leo Famulari To: Marius Bakke Subject: Re: bug#27221: [PATCH] gnu: qemu: Fix CVE-2017-{8112, 8309, 8379, 8380}. Message-ID: <20170604011238.GB30199@jasmine> References: <4591378184662a18cf89e307389896ab52ac9405.1496529304.git.leo@famulari.name> <87vaoczl3v.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="OwLcNYc0lM97+oe1" Content-Disposition: inline In-Reply-To: <87vaoczl3v.fsf@fastmail.com> User-Agent: Mutt/1.8.3 (2017-05-23) X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 27221-done Cc: 27221-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --OwLcNYc0lM97+oe1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jun 04, 2017 at 01:51:00AM +0200, Marius Bakke wrote: > Leo Famulari writes: >=20 > > * gnu/packages/patches/qemu-CVE-2017-8112.patch, > > gnu/packages/patches/qemu-CVE-2017-8309.patch, > > gnu/packages/patches/qemu-CVE-2017-8379.patch, > > gnu/packages/patches/qemu-CVE-2017-8380.patch: New files. > > * gnu/local.mk (dist_patch_DATA): Add them. > > * gnu/packages/qemu.scm (qemu)[source]: Use them. >=20 > LGTM. Thanks for keeping up with this. Thanks! Pushed as 8b5cb8d0542115b840b0086be1dbc00c116c7877. --OwLcNYc0lM97+oe1 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlkzXoYACgkQJkb6MLrK fwh7/xAAkewzvP3dT5KVv7y7i/u0sZAf0EMa9AYTy56ZjB8oKh6StxlAnWKS/Ksq 4AYQYyYKpZSBeQcVOD68P7nqbcb8Z9jr5M/AFZ8RAI5DKYVtx8JJvNx+HB8Kjhal DrMzTMKjeuaUDKC/xBZZHBxVo21YbG7nGdFb+Owbe+OAvyPIYwOGZRQyP6pMw57s 7g/Qp1ir+EVXzwdW4LxcNRRF01RPISAn1pF6NdMHFljy2U2LSwSZaddHtEu6gTDa vpihMg3sdG8zDxQEK4u14vSoQq9XS+dZ9xRlbgjaxGco7dYWG2vdoZG84I+6AG8V tOx663VJJhg1twxq2hHrdbuhLGXtD1KQxfKEhicjjuoQ9sJ6CzEWPhTs10UBmyoH VAAtHClu4FueP5UHDlBTsFxewF0KsHvuCj6hOdSfZbP13t7ULBBcgGB8UdOLkTYT sVUl83s88BTr2rUFlpAX7VI+J/a5zih63PfXUZ5lpfg5tKBxwZ2k4nZKOqUsM7Zl ETcE3pJSZxRvcHsIjXji/T6R2/gC+zQgrlRXxgHFt2t9rgE6SKHbbOAoW6Yuekad u5C3Bw/mSQ6NNh7Q3rWoaHgTk/goaowvUj9SGluqPdme45ZehMURVg2SZfIxmCWr rhaMTjyZVbtAsiR+B5RO8uHCu+gzpOB86Jh1mZd/qe1GiyOxKwY= =bxb5 -----END PGP SIGNATURE----- --OwLcNYc0lM97+oe1-- ------------=_1496538782-30759-1 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by debbugs.gnu.org; 3 Jun 2017 22:35:39 +0000 Received: from localhost ([127.0.0.1]:54304 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHHdr-00029N-Oz for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:39 -0400 Received: from eggs.gnu.org ([208.118.235.92]:57920) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dHHdn-000296-Sz for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dHHdg-0004DD-Nk for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:22 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:40027) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dHHdg-0004D4-Km for submit@debbugs.gnu.org; Sat, 03 Jun 2017 18:35:20 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48890) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dHHde-0002AA-3P for guix-patches@gnu.org; Sat, 03 Jun 2017 18:35:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dHHda-00048C-JG for guix-patches@gnu.org; Sat, 03 Jun 2017 18:35:18 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:32943) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dHHda-000472-27 for guix-patches@gnu.org; Sat, 03 Jun 2017 18:35:14 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 22D01206D3; Sat, 3 Jun 2017 18:35:13 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Sat, 03 Jun 2017 18:35:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:message-id:subject:to:x-me-sender:x-me-sender :x-sasl-enc:x-sasl-enc; s=mesmtp; bh=qlkAQawEF41JRaXj3iFRipaPhmh y30eEQcRiSD/ocu8=; b=n9IzpWe7/g/FT9Uw1d/G8ByVPCfUtWuFNi6WMnn7wcu G6W4jDmeVBUtGuTRZ3nPdn5S+vVTSAEY9f919unUvQ5CTavd/o6eNGvV7+dC8LY5 foKPRqv7P92hGf6UBfz4Y0KWTy9JVTemU+XWNckXHX7XFqIDsaVJncqpRObwYENE = DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=qlkAQa wEF41JRaXj3iFRipaPhmhy30eEQcRiSD/ocu8=; b=rnKwfHsUgqt8Bry5p3gczw 9ewHUuggkragsqKXpI1Wot81Ixz/qZq16bw4Vlzy9HzDyiAB25dzzRiQ/E/cr56U ECrfvWoh15UVZCghdTBJOwycV9wuVPQUTDi12BpmrxCI+Vekv0QH27xdJTHlfdAw JjYJNMr4sauHnUFfR215DREjrm6NheDkE5ozPcVK7SLuSNdN96okCCwLJH9NQM19 7IdphMuhxEothtLxICP3ibJbeg96yLBk/Ur3UC6P33NNHGU5YwX3wI5wazNnsTD7 td27i0LFk+LwUTRZLqhKQBlVk9JpiEDcN6usX1EvBp3HC/excs+cXCjkp4DQK8tQ == X-ME-Sender: X-Sasl-enc: r4KP+enOHW8oVkTZ3qz8vAZ1dZh0RMGtAkm6xLrp1M7P 1496529312 Received: from localhost.localdomain (unknown [84.19.184.51]) by mail.messagingengine.com (Postfix) with ESMTPA id 4BDFB24753 for ; Sat, 3 Jun 2017 18:35:12 -0400 (EDT) From: Leo Famulari To: guix-patches@gnu.org Subject: [PATCH] gnu: qemu: Fix CVE-2017-{8112,8309,8379,8380}. Date: Sat, 3 Jun 2017 18:35:04 -0400 Message-Id: <4591378184662a18cf89e307389896ab52ac9405.1496529304.git.leo@famulari.name> X-Mailer: git-send-email 2.13.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.9 (/) * gnu/packages/patches/qemu-CVE-2017-8112.patch, gnu/packages/patches/qemu-CVE-2017-8309.patch, gnu/packages/patches/qemu-CVE-2017-8379.patch, gnu/packages/patches/qemu-CVE-2017-8380.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/qemu.scm (qemu)[source]: Use them. --- gnu/local.mk | 4 ++ gnu/packages/patches/qemu-CVE-2017-8112.patch | 41 +++++++++++ gnu/packages/patches/qemu-CVE-2017-8309.patch | 46 +++++++++++++ gnu/packages/patches/qemu-CVE-2017-8379.patch | 98 +++++++++++++++++++++++++++ gnu/packages/patches/qemu-CVE-2017-8380.patch | 53 +++++++++++++++ gnu/packages/qemu.scm | 6 +- 6 files changed, 247 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/qemu-CVE-2017-8112.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-8309.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-8379.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-8380.patch diff --git a/gnu/local.mk b/gnu/local.mk index e7d5ee2f4..85bcbd632 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -953,6 +953,10 @@ dist_patch_DATA = \ %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch \ %D%/packages/patches/python2-subprocess32-disable-input-test.patch \ %D%/packages/patches/qemu-CVE-2017-7493.patch \ + %D%/packages/patches/qemu-CVE-2017-8112.patch \ + %D%/packages/patches/qemu-CVE-2017-8309.patch \ + %D%/packages/patches/qemu-CVE-2017-8379.patch \ + %D%/packages/patches/qemu-CVE-2017-8380.patch \ %D%/packages/patches/qt4-ldflags.patch \ %D%/packages/patches/qtscript-disable-tests.patch \ %D%/packages/patches/quickswitch-fix-dmenu-check.patch \ diff --git a/gnu/packages/patches/qemu-CVE-2017-8112.patch b/gnu/packages/patches/qemu-CVE-2017-8112.patch new file mode 100644 index 000000000..88b33aa2f --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8112.patch @@ -0,0 +1,41 @@ +Fix CVE-2017-8112: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8112 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=f68826989cd4d1217797251339579c57b3c0934e + +From f68826989cd4d1217797251339579c57b3c0934e Mon Sep 17 00:00:00 2001 +From: P J P +Date: Tue, 25 Apr 2017 18:36:23 +0530 +Subject: [PATCH] vmw_pvscsi: check message ring page count at initialisation + +A guest could set the message ring page count to zero, resulting in +infinite loop. Add check to avoid it. + +Reported-by: YY Z +Signed-off-by: P J P +Message-Id: <20170425130623.3649-1-ppandit@redhat.com> +Reviewed-by: Dmitry Fleytman +Signed-off-by: Paolo Bonzini +--- + hw/scsi/vmw_pvscsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c +index 75575461e2..4a106da856 100644 +--- a/hw/scsi/vmw_pvscsi.c ++++ b/hw/scsi/vmw_pvscsi.c +@@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri) + uint32_t len_log2; + uint32_t ring_size; + +- if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { ++ if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { + return -1; + } + ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE; +-- +2.13.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-8309.patch b/gnu/packages/patches/qemu-CVE-2017-8309.patch new file mode 100644 index 000000000..dc4b4006b --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8309.patch @@ -0,0 +1,46 @@ +Fix CVE-2017-8309: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8309 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=3268a845f41253fb55852a8429c32b50f36f349a + +From 3268a845f41253fb55852a8429c32b50f36f349a Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 28 Apr 2017 09:56:12 +0200 +Subject: [PATCH] audio: release capture buffers + +AUD_add_capture() allocates two buffers which are never released. +Add the missing calls to AUD_del_capture(). + +Impact: Allows vnc clients to exhaust host memory by repeatedly +starting and stopping audio capture. + +Fixes: CVE-2017-8309 +Cc: P J P +Cc: Huawei PSIRT +Reported-by: "Jiangxin (hunter, SCC)" +Signed-off-by: Gerd Hoffmann +Reviewed-by: Prasad J Pandit +Message-id: 20170428075612.9997-1-kraxel@redhat.com +--- + audio/audio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/audio/audio.c b/audio/audio.c +index c8898d8422..beafed209b 100644 +--- a/audio/audio.c ++++ b/audio/audio.c +@@ -2028,6 +2028,8 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque) + sw = sw1; + } + QLIST_REMOVE (cap, entries); ++ g_free (cap->hw.mix_buf); ++ g_free (cap->buf); + g_free (cap); + } + return; +-- +2.13.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-8379.patch b/gnu/packages/patches/qemu-CVE-2017-8379.patch new file mode 100644 index 000000000..200b133d3 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8379.patch @@ -0,0 +1,98 @@ +Fix CVE-2017-8379: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8379 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=fa18f36a461984eae50ab957e47ec78dae3c14fc + +From fa18f36a461984eae50ab957e47ec78dae3c14fc Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Fri, 28 Apr 2017 10:42:37 +0200 +Subject: [PATCH] input: limit kbd queue depth + +Apply a limit to the number of items we accept into the keyboard queue. + +Impact: Without this limit vnc clients can exhaust host memory by +sending keyboard events faster than qemu feeds them to the guest. + +Fixes: CVE-2017-8379 +Cc: P J P +Cc: Huawei PSIRT +Reported-by: jiangxin1@huawei.com +Signed-off-by: Gerd Hoffmann +Message-id: 20170428084237.23960-1-kraxel@redhat.com +--- + ui/input.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/ui/input.c b/ui/input.c +index ed88cda6d6..fb1f404095 100644 +--- a/ui/input.c ++++ b/ui/input.c +@@ -41,6 +41,8 @@ static QTAILQ_HEAD(QemuInputEventQueueHead, QemuInputEventQueue) kbd_queue = + QTAILQ_HEAD_INITIALIZER(kbd_queue); + static QEMUTimer *kbd_timer; + static uint32_t kbd_default_delay_ms = 10; ++static uint32_t queue_count; ++static uint32_t queue_limit = 1024; + + QemuInputHandlerState *qemu_input_handler_register(DeviceState *dev, + QemuInputHandler *handler) +@@ -268,6 +270,7 @@ static void qemu_input_queue_process(void *opaque) + break; + } + QTAILQ_REMOVE(queue, item, node); ++ queue_count--; + g_free(item); + } + } +@@ -282,6 +285,7 @@ static void qemu_input_queue_delay(struct QemuInputEventQueueHead *queue, + item->delay_ms = delay_ms; + item->timer = timer; + QTAILQ_INSERT_TAIL(queue, item, node); ++ queue_count++; + + if (start_timer) { + timer_mod(item->timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +@@ -298,6 +302,7 @@ static void qemu_input_queue_event(struct QemuInputEventQueueHead *queue, + item->src = src; + item->evt = evt; + QTAILQ_INSERT_TAIL(queue, item, node); ++ queue_count++; + } + + static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue) +@@ -306,6 +311,7 @@ static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue) + + item->type = QEMU_INPUT_QUEUE_SYNC; + QTAILQ_INSERT_TAIL(queue, item, node); ++ queue_count++; + } + + void qemu_input_event_send_impl(QemuConsole *src, InputEvent *evt) +@@ -381,7 +387,7 @@ void qemu_input_event_send_key(QemuConsole *src, KeyValue *key, bool down) + qemu_input_event_send(src, evt); + qemu_input_event_sync(); + qapi_free_InputEvent(evt); +- } else { ++ } else if (queue_count < queue_limit) { + qemu_input_queue_event(&kbd_queue, src, evt); + qemu_input_queue_sync(&kbd_queue); + } +@@ -409,8 +415,10 @@ void qemu_input_event_send_key_delay(uint32_t delay_ms) + kbd_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, qemu_input_queue_process, + &kbd_queue); + } +- qemu_input_queue_delay(&kbd_queue, kbd_timer, +- delay_ms ? delay_ms : kbd_default_delay_ms); ++ if (queue_count < queue_limit) { ++ qemu_input_queue_delay(&kbd_queue, kbd_timer, ++ delay_ms ? delay_ms : kbd_default_delay_ms); ++ } + } + + InputEvent *qemu_input_event_new_btn(InputButton btn, bool down) +-- +2.13.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-8380.patch b/gnu/packages/patches/qemu-CVE-2017-8380.patch new file mode 100644 index 000000000..65e49fc88 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-8380.patch @@ -0,0 +1,53 @@ +Fix CVE-2017-8380: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8380 + +Patch copied from upstream source repository: + +http://git.qemu.org/?p=qemu.git;a=commitdiff;h=24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f + +From 24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Mon, 24 Apr 2017 17:36:34 +0530 +Subject: [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write + +While reading magic sequence(MFI_SEQ) in megasas_mmio_write, +an off-by-one error could occur as 's->adp_reset' index is not +reset after reading the last sequence. + +Reported-by: YY Z +Signed-off-by: Prasad J Pandit +Message-Id: <20170424120634.12268-1-ppandit@redhat.com> +Signed-off-by: Paolo Bonzini +--- + hw/scsi/megasas.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c +index 84b8caf901..804122ab05 100644 +--- a/hw/scsi/megasas.c ++++ b/hw/scsi/megasas.c +@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr, + case MFI_SEQ: + trace_megasas_mmio_writel("MFI_SEQ", val); + /* Magic sequence to start ADP reset */ +- if (adp_reset_seq[s->adp_reset] == val) { +- s->adp_reset++; ++ if (adp_reset_seq[s->adp_reset++] == val) { ++ if (s->adp_reset == 6) { ++ s->adp_reset = 0; ++ s->diag = MFI_DIAG_WRITE_ENABLE; ++ } + } else { + s->adp_reset = 0; + s->diag = 0; + } +- if (s->adp_reset == 6) { +- s->diag = MFI_DIAG_WRITE_ENABLE; +- } + break; + case MFI_DIAG: + trace_megasas_mmio_writel("MFI_DIAG", val); +-- +2.13.0 + diff --git a/gnu/packages/qemu.scm b/gnu/packages/qemu.scm index 0734b6d0f..31354b25d 100644 --- a/gnu/packages/qemu.scm +++ b/gnu/packages/qemu.scm @@ -74,7 +74,11 @@ (method url-fetch) (uri (string-append "http://wiki.qemu-project.org/download/qemu-" version ".tar.xz")) - (patches (search-patches "qemu-CVE-2017-7493.patch")) + (patches (search-patches "qemu-CVE-2017-7493.patch" + "qemu-CVE-2017-8112.patch" + "qemu-CVE-2017-8309.patch" + "qemu-CVE-2017-8379.patch" + "qemu-CVE-2017-8380.patch")) (sha256 (base32 "08mhfs0ndbkyqgw7fjaa9vjxf4dinrly656f6hjzvmaz7hzc677h")))) -- 2.13.0 ------------=_1496538782-30759-1--