Re: [OE-core] [PATCH] qemu: CVE-2018-18438 Security Advisory

["Wang Mingyu" <wangmy@cn.fujitsu.com>]

Hi Richard,

> I went digging and was pointed to
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1609015
In the discussion, "patches were applied upstream to prevent future changes introducing such flames" was explained. 
It seems that CVE doesn't think this is a problem, but the upstream still applied this patch. 
In this case, is it need to submit CVE patch? Or submit it as a normal patch?

Best regards,
Wangmy

> -----Original Message-----
> From: Richard Purdie <richard.purdie@linuxfoundation.org>
> Sent: Friday, January 22, 2021 10:06 PM
> To: Wang, Mingyu/王 鸣瑜 <wangmy@cn.fujitsu.com>;
> openembedded-core@lists.openembedded.org
> Cc: Steve Sakoman <steve@sakoman.com>; Ross Burton
> <ross@burtonini.com>
> Subject: Re: [OE-core] [PATCH] qemu: CVE-2018-18438 Security Advisory
> 
> On Fri, 2021-01-22 at 10:14 +0000, Richard Purdie via
> lists.openembedded.org wrote:
> > On Fri, 2021-01-22 at 15:15 +0800, Wang Mingyu wrote:
> > >
> > > diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2018-18438.patch
> > > b/meta/recipes-devtools/qemu/qemu/CVE-2018-18438.patch
> > > new file mode 100644
> > > index 0000000000..b6ce8fa57d
> > > --- /dev/null
> > > +++ b/meta/recipes-devtools/qemu/qemu/CVE-2018-18438.patch
> > > @@ -0,0 +1,697 @@
> > > +From:	Philippe Mathieu-Daudé
> > > +Subject:	[Qemu-devel] [PATCH v2 07/11] chardev: Let IOReadHandler
> use unsigned type
> > > +Date:	Fri, 12 Oct 2018 02:22:13 +0200
> > > +
> > > +The number of bytes can not be negative nor zero.
> > > +
> > > +Fixed 2 format string:
> > > +- hw/char/spapr_vty.c
> > > +- hw/usb/ccid-card-passthru.c
> >
> > No Upstream-Status.
> >
> > Its also unclear what the status of these patches is upstream, they're
> > submitted, there was discussion but they weren't merged. I'm also
> > wondering whether there are more of the 11 patches in the series
> > needed to address the issue? Or perhaps the issue was ultimately
> > addressed by other patches?
> 
> I went digging and was pointed to
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1609015
> 
> i.e. qemu upstream and Redhat believe this is not an issue
> 
> Steve: What do we do here? Whitelist? Do we report upstream somehow?
> 
> Cheers,
> 
> Richard
> 
>