[prev in list] [next in list] [prev in thread] [next in thread] 

List:       openembedded-core
Subject:    Re: [OE-core] [gatesgarth][PATCH v2] qemu: fix CVE-2021-3392
From:       "Anuj Mittal" <anuj.mittal () intel ! com>
Date:       2021-04-30 14:51:18
Message-ID: bb20da39d53c6975f86fd108a000fc359b1a1c80.camel () intel ! com
[Download RAW message or body]

[Attachment #2 (unknown)]

Hi,

On Tue, 2021-04-27 at 17:25 +0900, Minjae Kim wrote:
> scsi: use-after-free in mptsas_process_scsi_io_request() of
> mptsas1068 emulator

I have the same comment for this as well. This patch should be replaced
by the one merged upstream.

Thanks,

Anuj

> ---
>  meta/recipes-devtools/qemu/qemu.inc           |  1 +
>  .../qemu/qemu/CVE-2021-3392.patch             | 45
> +++++++++++++++++++
>  2 files changed, 46 insertions(+)
>  create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-
> 3392.patch
> 
> diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-
> devtools/qemu/qemu.inc
> index 5e8d3e09ff..7647e44726 100644
> --- a/meta/recipes-devtools/qemu/qemu.inc
> +++ b/meta/recipes-devtools/qemu/qemu.inc
> @@ -54,6 +54,7 @@ SRC_URI = "
> https://download.qemu.org/${BPN}-${PV}.tar.xz \
>            file://CVE-2020-24352.patch \
>            file://CVE-2020-25723.patch \
>            file://CVE-2021-20203.patch \
> +          file://CVE-2021-3392.patch \
>            "
>  UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
>  
> diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch
> b/meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch
> new file mode 100644
> index 0000000000..1c688827db
> --- /dev/null
> +++ b/meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch
> @@ -0,0 +1,45 @@
> +From 3431b01b43584de5f710c40605fe3251f81c0e11 Mon Sep 17 00:00:00
> 2001
> +From: Minjae Kim <flowergom@gmail.com>
> +Date: Tue, 27 Apr 2021 02:09:49 +0000
> +Subject: [PATCH] scsi: mptsas: dequeue request object in case of an
> error
> + (CVE-2021-3392)
> +
> +From: Prasad J Pandit <pjp@fedoraproject.org>
> +
> +While processing SCSI i/o requests in
> mptsas_process_scsi_io_request(),
> +the Megaraid emulator appends new MPTSASRequest object 'req' to
> +the 's->pending' queue. In case of an error, this same object gets
> +dequeued in mptsas_free_request() only if SCSIRequest object
> +'req->sreq' is initialised. This may lead to a use-after-free issue.
> +Unconditionally dequeue 'req' object from 's->pending' to avoid it.
> +
> +Fixes: CVE-2021-3392
> +Buglink: https://bugs.launchpad.net/qemu/+bug/1914236
> +Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> +
> +Upstream-Status: Acepted
> +[https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg00488.html
> ]
> +CVE: CVE-2021-3392
> +Signed-off-by: Minjae Kim <flowergom@gmail.com>
> +---
> + hw/scsi/mptsas.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
> +index f86616544..adff5b0bf 100644
> +--- a/hw/scsi/mptsas.c
> ++++ b/hw/scsi/mptsas.c
> +@@ -257,8 +257,8 @@ static void mptsas_free_request(MPTSASRequest
> *req)
> +         req->sreq->hba_private = NULL;
> +         scsi_req_unref(req->sreq);
> +         req->sreq = NULL;
> +-        QTAILQ_REMOVE(&s->pending, req, next);
> +     }
> ++    QTAILQ_REMOVE(&s->pending, req, next);
> +     qemu_sglist_destroy(&req->qsg);
> +     g_free(req);
> + }
> +-- 
> +2.17.1
> +
> 
> 
> 



-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#151133): https://lists.openembedded.org/g/openembedded-core/message/151133
Mute This Topic: https://lists.openembedded.org/mt/82399408/4454766
Group Owner: openembedded-core+owner@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [openembedded-core@marc.info]
-=-=-=-=-=-=-=-=-=-=-=-



[prev in list] [next in list] [prev in thread] [next in thread]