diff options
| author |   Matthias Maier <tamiko@gentoo.org> | 2016-09-05 00:18:46 -0500 |
|---|---|---|
| committer | Matthias Maier <tamiko@gentoo.org> | 2016-09-05 00:30:00 -0500 |
| commit | ceb67390ecbe843f184b5bde6428cb9e2f3dcd81 (patch) | |
| tree | 2acc0ac7d32135b4e5aa72c04c38677a15a8a95c | |
| parent | app-emulation/qemu: version bump to 2.7.0, various security fixes (diff) | |
| download | gentoo-ceb67390.tar.gz gentoo-ceb67390.tar.bz2 gentoo-ceb67390.zip | |
app-emulation/qemu: apply patch for CVE-2016-6836, bug #591242
Package-Manager: portage-2.2.28
| -rw-r--r-- | app-emulation/qemu/files/qemu-2.7.0-CVE-2016-6836.patch | 27 | ||||
| -rw-r--r-- | app-emulation/qemu/qemu-2.7.0.ebuild | 1 |
2 files changed, 28 insertions, 0 deletions
diff --git a/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-6836.patch b/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-6836.patch new file mode 100644 index 000000000000..56f7435df5b6 --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-6836.patch @@ -0,0 +1,27 @@ +From: Li Qiang <address@hidden> + +In Vmxnet3 device emulator while processing transmit(tx) queue, +when it reaches end of packet, it calls vmxnet3_complete_packet. +In that local 'txcq_descr' object is not initialised, which could +leak host memory bytes a guest. + +Reported-by: Li Qiang <address@hidden> +Signed-off-by: Prasad J Pandit <address@hidden> +--- + hw/net/vmxnet3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c +index 90f6943..92f6af9 100644 +--- a/hw/net/vmxnet3.c ++++ b/hw/net/vmxnet3.c +@@ -531,6 +531,7 @@ static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx) + + VMXNET3_RING_DUMP(VMW_RIPRN, "TXC", qidx, &s->txq_descr[qidx].comp_ring); + ++ memset(&txcq_descr, 0, sizeof(txcq_descr)); + txcq_descr.txdIdx = tx_ridx; + txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring); + +-- +2.5.5 diff --git a/app-emulation/qemu/qemu-2.7.0.ebuild b/app-emulation/qemu/qemu-2.7.0.ebuild index 6f65fc9170b0..a3aefc26788b 100644 --- a/app-emulation/qemu/qemu-2.7.0.ebuild +++ b/app-emulation/qemu/qemu-2.7.0.ebuild @@ -333,6 +333,7 @@ src_prepare() { epatch "${FILESDIR}"/${PN}-2.5.0-cflags.patch epatch "${FILESDIR}"/${PN}-2.5.0-sysmacros.patch + epatch "${FILESDIR}"/${P}-CVE-2016-6836.patch # Fix ld and objcopy being called directly tc-export AR LD OBJCOPY |