]> git.proxmox.com Git - pve-qemu.git/commit
add patch for CVE-2019-20382 (vnc disconnect memory leak)
authorOguz Bektas <o.bektas@proxmox.com>
Thu, 5 Mar 2020 12:29:13 +0000 (13:29 +0100)
committerThomas Lamprecht <t.lamprecht@proxmox.com>
Thu, 5 Mar 2020 12:34:29 +0000 (13:34 +0100)
commitee8bd5bfbe81a3c24d2aa3306f5e060bff86c353
tree7471a9eb0e6d3f69b1475af36979b0b7c1b970db
parent487df43ff9e42f633d01d1705039cf0c0436c571
add patch for CVE-2019-20382 (vnc disconnect memory leak)

oss-security email can be found here[0]

upstream commit here[1]

this effects our vncproxy. dominik and me tested if the issue is present
on our branch and it appears that it is.
in essence when we disconnect from a vnc connection, the memory isn't
free'd afterwards which causes the qemu process to use more and more
memory with each disconnect, which could lead to a dos scenario.

we tested the patch and it seems to mitigate the problem.

[0]: https://seclists.org/oss-sec/2020/q1/105
[1]: https://git.qemu.org/?p=qemu.git;a=commitdiff;h=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0

Tested-by: Dominik Csapak <d.csapak@proxmox.com>
Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
debian/patches/extra/0003-vnc-fix-memory-leak-when-vnc-disconnect.patch [new file with mode: 0644]
debian/patches/series