All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peter Maydell <peter.maydell@linaro.org>
To: Eric Blake <eblake@redhat.com>
Cc: "Daniel P. Berrangé" <berrange@redhat.com>,
	"QEMU Developers" <qemu-devel@nongnu.org>,
	"Peter Maydell" <peter.maydell@linaro.org>,
	"Thomas Huth" <thuth@redhat.com>, "Greg Kurz" <groug@kaod.org>,
	"Bandan Das" <bsd@redhat.com>,
	"Gerd Hoffmann" <kraxel@redhat.com>
Subject: Re: [Qemu-devel] [PATCH for-4.0? 0/3] usb-mtp: fix ObjectInfo request handling
Date: Mon, 15 Apr 2019 18:18:01 +0100	[thread overview]
Message-ID: <CAFEAcA9ndqdFv8hkMhjVudbajTDLZtcu7rpSdR5OFiqiJtp1bg@mail.gmail.com> (raw)
In-Reply-To: <83042152-1af4-a237-92a1-f56841623e89@redhat.com>

On Mon, 15 Apr 2019 at 18:10, Eric Blake <eblake@redhat.com> wrote:
> On 4/15/19 10:45 AM, Daniel P. Berrangé wrote:
> > The 2nd patch in this series is a security flaw fix since the
> > code was not correctly validating guest provided data length.
>
> Given that this is a security flaw, I've added this series to
> https://wiki.qemu.org/Planning/4.0 in case you're hoping to get it in -rc4.

What are the consequences of the flaw ? IIRC it's only one
extra byte read?

thanks
-- PMM

WARNING: multiple messages have this Message-ID (diff)
From: Peter Maydell <peter.maydell@linaro.org>
To: Eric Blake <eblake@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>,
	Thomas Huth <thuth@redhat.com>,
	QEMU Developers <qemu-devel@nongnu.org>,
	Greg Kurz <groug@kaod.org>, Bandan Das <bsd@redhat.com>,
	Gerd Hoffmann <kraxel@redhat.com>
Subject: Re: [Qemu-devel] [PATCH for-4.0? 0/3] usb-mtp: fix ObjectInfo request handling
Date: Mon, 15 Apr 2019 18:18:01 +0100	[thread overview]
Message-ID: <CAFEAcA9ndqdFv8hkMhjVudbajTDLZtcu7rpSdR5OFiqiJtp1bg@mail.gmail.com> (raw)
Message-ID: <20190415171801.oHO21RNffjd2OZBv48moNcpxORx9Ptpr_GKOBCPesJ4@z> (raw)
In-Reply-To: <83042152-1af4-a237-92a1-f56841623e89@redhat.com>

On Mon, 15 Apr 2019 at 18:10, Eric Blake <eblake@redhat.com> wrote:
> On 4/15/19 10:45 AM, Daniel P. Berrangé wrote:
> > The 2nd patch in this series is a security flaw fix since the
> > code was not correctly validating guest provided data length.
>
> Given that this is a security flaw, I've added this series to
> https://wiki.qemu.org/Planning/4.0 in case you're hoping to get it in -rc4.

What are the consequences of the flaw ? IIRC it's only one
extra byte read?

thanks
-- PMM


  reply	other threads:[~2019-04-15 17:18 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-15 15:45 [Qemu-devel] [PATCH 0/3] usb-mtp: fix ObjectInfo request handling Daniel P. Berrangé
2019-04-15 15:45 ` Daniel P. Berrangé
2019-04-15 15:45 ` [Qemu-devel] [PATCH 1/3] usb-mtp: fix string length for filename when writing metadata Daniel P. Berrangé
2019-04-15 15:45   ` Daniel P. Berrangé
2019-04-15 17:02   ` Bandan Das
2019-04-15 17:02     ` Bandan Das
2019-04-15 15:45 ` [Qemu-devel] [PATCH 2/3] usb-mtp: fix bounds check for guest provided filename Daniel P. Berrangé
2019-04-15 15:45   ` Daniel P. Berrangé
2019-04-16 19:41   ` Bandan Das
2019-04-16 19:41     ` Bandan Das
2019-04-15 15:45 ` [Qemu-devel] [PATCH 3/3] usb-mtp: fix alignment of access of ObjectInfo filename field Daniel P. Berrangé
2019-04-15 15:45   ` Daniel P. Berrangé
2019-04-15 16:52 ` [Qemu-devel] [PATCH 0/3] usb-mtp: fix ObjectInfo request handling Bandan Das
2019-04-15 16:52   ` Bandan Das
2019-04-15 16:54   ` Daniel P. Berrangé
2019-04-15 16:54     ` Daniel P. Berrangé
2019-04-16  8:40     ` Daniel P. Berrangé
2019-04-16  8:40       ` Daniel P. Berrangé
2019-04-16 16:10       ` Bandan Das
2019-04-16 16:10         ` Bandan Das
2019-04-16 16:12         ` Daniel P. Berrangé
2019-04-16 16:12           ` Daniel P. Berrangé
2019-04-16 16:45           ` Bandan Das
2019-04-16 16:45             ` Bandan Das
2019-04-16 16:52             ` Daniel P. Berrangé
2019-04-16 16:52               ` Daniel P. Berrangé
2019-04-16 17:20               ` Bandan Das
2019-04-16 17:20                 ` Bandan Das
2019-04-15 17:09 ` [Qemu-devel] [PATCH for-4.0? " Eric Blake
2019-04-15 17:09   ` Eric Blake
2019-04-15 17:18   ` Peter Maydell [this message]
2019-04-15 17:18     ` Peter Maydell
2019-04-16  8:48     ` Daniel P. Berrangé
2019-04-16  8:48       ` Daniel P. Berrangé
2019-04-16 13:35 ` [Qemu-devel] [PATCH " Peter Maydell
2019-04-16 13:35   ` Peter Maydell
2019-04-16 17:27   ` Peter Maydell
2019-04-16 17:27     ` Peter Maydell
2019-04-16 19:33     ` Peter Maydell
2019-04-16 19:33       ` Peter Maydell
2019-04-16 22:27       ` Peter Maydell
2019-04-16 22:27         ` Peter Maydell
2019-04-17  8:27         ` Gerd Hoffmann
2019-04-17  8:27           ` Gerd Hoffmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAFEAcA9ndqdFv8hkMhjVudbajTDLZtcu7rpSdR5OFiqiJtp1bg@mail.gmail.com \
    --to=peter.maydell@linaro.org \
    --cc=berrange@redhat.com \
    --cc=bsd@redhat.com \
    --cc=eblake@redhat.com \
    --cc=groug@kaod.org \
    --cc=kraxel@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=thuth@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.