From a2bbedb880ff9d37549c1e0e334177ce0dc88937 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Mon, 23 Sep 2019 02:12:03 +0000 Subject: [PATCH] qemu: patch for CVE-2019-15890 Signed-off-by: Yousong Zhou --- utils/qemu/Makefile | 2 +- ...005-slirp-ipreass-fix-use-after-free.patch | 46 +++++++++++++++++++ 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch diff --git a/utils/qemu/Makefile b/utils/qemu/Makefile index 43eeeaccd..ccaa6ef0c 100644 --- a/utils/qemu/Makefile +++ b/utils/qemu/Makefile @@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=qemu PKG_VERSION:=4.1.0 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_HASH:=656e60218689bdeec69903087fd7582d5d3e72238d02f4481d8dc6d79fd909c6 PKG_SOURCE_URL:=http://download.qemu.org/ diff --git a/utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch b/utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch new file mode 100644 index 000000000..45f37d32d --- /dev/null +++ b/utils/qemu/patches/0005-slirp-ipreass-fix-use-after-free.patch @@ -0,0 +1,46 @@ +From c59279437eda91841b9d26079c70b8a540d41204 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Mon, 26 Aug 2019 00:55:03 +0200 +Subject: [PATCH] ip_reass: Fix use after free + +Using ip_deq after m_free might read pointers from an allocation reuse. + +This would be difficult to exploit, but that is still related with +CVE-2019-14378 which generates fragmented IP packets that would trigger this +issue and at least produce a DoS. + +Signed-off-by: Samuel Thibault +--- +Taken from https://gitlab.freedesktop.org/slirp/libslirp/commit/c5927943 + + slirp/src/ip_input.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c +index 7364ce0..aa514ae 100644 +--- a/slirp/src/ip_input.c ++++ b/slirp/src/ip_input.c +@@ -292,6 +292,7 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp) + */ + while (q != (struct ipasfrag *)&fp->frag_link && + ip->ip_off + ip->ip_len > q->ipf_off) { ++ struct ipasfrag *prev; + i = (ip->ip_off + ip->ip_len) - q->ipf_off; + if (i < q->ipf_len) { + q->ipf_len -= i; +@@ -299,9 +300,10 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp) + m_adj(dtom(slirp, q), i); + break; + } ++ prev = q; + q = q->ipf_next; +- m_free(dtom(slirp, q->ipf_prev)); +- ip_deq(q->ipf_prev); ++ ip_deq(prev); ++ m_free(dtom(slirp, prev)); + } + + insert: +-- +2.22.0 +