qemu: patch for CVE-2019-15890

Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>

diff --git a/utils/qemu/Makefile b/utils/qemu/Makefile
index 43eeeaccd531416fca2e92134cc6e3590a8d3333..ccaa6ef0c756fd6476a69ec6631ca340491cdb8e 100644 (file)
--- a/utils/qemu/Makefile
+++ b/utils/qemu/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=qemu
 PKG_VERSION:=4.1.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_HASH:=656e60218689bdeec69903087fd7582d5d3e72238d02f4481d8dc6d79fd909c6
 PKG_SOURCE_URL:=http://download.qemu.org/

diff --git a/utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch b/utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch
new file mode 100644 (file)
index 0000000..45f37d3
--- /dev/null
+++ b/utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch
@@ -0,0 +1,46 @@
+From c59279437eda91841b9d26079c70b8a540d41204 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Mon, 26 Aug 2019 00:55:03 +0200
+Subject: [PATCH] ip_reass: Fix use after free
+
+Using ip_deq after m_free might read pointers from an allocation reuse.
+
+This would be difficult to exploit, but that is still related with
+CVE-2019-14378 which generates fragmented IP packets that would trigger this
+issue and at least produce a DoS.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+---
+Taken from https://gitlab.freedesktop.org/slirp/libslirp/commit/c5927943
+
+ slirp/src/ip_input.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
+index 7364ce0..aa514ae 100644
+--- a/slirp/src/ip_input.c
++++ b/slirp/src/ip_input.c
+@@ -292,6 +292,7 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
+      */
+     while (q != (struct ipasfrag *)&fp->frag_link &&
+            ip->ip_off + ip->ip_len > q->ipf_off) {
++        struct ipasfrag *prev;
+         i = (ip->ip_off + ip->ip_len) - q->ipf_off;
+         if (i < q->ipf_len) {
+             q->ipf_len -= i;
+@@ -299,9 +300,10 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
+             m_adj(dtom(slirp, q), i);
+             break;
+         }
++        prev = q;
+         q = q->ipf_next;
+-        m_free(dtom(slirp, q->ipf_prev));
+-        ip_deq(q->ipf_prev);
++        ip_deq(prev);
++        m_free(dtom(slirp, prev));
+     }
+ 
+ insert:
+-- 
+2.22.0
+