From: Sakib Sajal <sakib.sajal@windriver.com>
To: <openembedded-core@lists.openembedded.org>
Subject: [hardknott][PATCH 4/8] qemu: fix CVE-2021-3594
Date: Wed, 2 Feb 2022 10:47:16 -0500 [thread overview]
Message-ID: <20220202154720.18976-4-sakib.sajal@windriver.com> (raw)
In-Reply-To: <20220202154720.18976-1-sakib.sajal@windriver.com>
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
---
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2021-3594.patch | 40 +++++++++++++++++++
2 files changed, 41 insertions(+)
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-3594.patch
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 811bdff426..4198d3a52c 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -76,6 +76,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2021-3593.patch \
file://CVE-2021-3595_1.patch \
file://CVE-2021-3595_2.patch \
+ file://CVE-2021-3594.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3594.patch b/meta/recipes-devtools/qemu/qemu/CVE-2021-3594.patch
new file mode 100644
index 0000000000..c99ba7a7cc
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3594.patch
@@ -0,0 +1,40 @@
+From 7a5ffd5475f2cbfe3cf91d9584893f1a4b3b4dff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
+Date: Fri, 4 Jun 2021 16:40:23 +0400
+Subject: [PATCH 07/12] udp: check upd_input buffer size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes: CVE-2021-3594
+Fixes: https://gitlab.freedesktop.org/slirp/libslirp/-/issues/47
+
+Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+
+Upstream-Status: Backport [74572be49247c8c5feae7c6e0b50c4f569ca9824]
+CVE: CVE-2021-3594
+
+Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
+---
+ slirp/src/udp.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/slirp/src/udp.c b/slirp/src/udp.c
+index 0ad44d7c0..18b4acdfa 100644
+--- a/slirp/src/udp.c
++++ b/slirp/src/udp.c
+@@ -93,7 +93,10 @@ void udp_input(register struct mbuf *m, int iphlen)
+ /*
+ * Get IP and UDP header together in first mbuf.
+ */
+- ip = mtod(m, struct ip *);
++ ip = mtod_check(m, iphlen + sizeof(struct udphdr));
++ if (ip == NULL) {
++ goto bad;
++ }
+ uh = (struct udphdr *)((char *)ip + iphlen);
+
+ /*
+--
+2.31.1
+
--
2.33.0
next prev parent reply other threads:[~2022-02-02 15:47 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-02 15:47 [hardknott][PATCH 1/8] qemu: fix CVE-2021-3592 Sakib Sajal
2022-02-02 15:47 ` [hardknott][PATCH 2/8] qemu: fix CVE-2021-3593 Sakib Sajal
2022-02-02 15:47 ` [hardknott][PATCH 3/8] qemu: fix CVE-2021-3595 Sakib Sajal
2022-02-02 15:47 ` Sakib Sajal [this message]
2022-02-02 15:47 ` [hardknott][PATCH 5/8] qemu: fix CVE-2021-3713 Sakib Sajal
2022-02-02 15:47 ` [hardknott][PATCH 6/8] qemu: fix CVE-2021-3748 Sakib Sajal
2022-02-02 15:47 ` [hardknott][PATCH 7/8] qemu: fix CVE-2021-3930 Sakib Sajal
2022-02-02 15:47 ` [hardknott][PATCH 8/8] qemu: fix CVE-2021-20196 Sakib Sajal
-- strict thread matches above, loose matches on Subject: below --
2022-01-14 18:03 [hardknott][PATCH 1/8] qemu: fix CVE-2021-3592 Sakib Sajal
2022-01-14 18:03 ` [hardknott][PATCH 4/8] qemu: fix CVE-2021-3594 Sakib Sajal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220202154720.18976-4-sakib.sajal@windriver.com \
--to=sakib.sajal@windriver.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).