From: Wolfgang Bumiller Date: Mon, 5 Aug 2019 09:22:09 +0000 (+0200) Subject: merge fix for CVE-2019-14378 X-Git-Url: https://git.proxmox.com/?p=pve-qemu.git;a=commitdiff_plain;h=d09c80068ad08c75c8d7a505a924dcbacd2344d6;hp=92f7f9e8075db9f58e2f7528d60305b67e12289c merge fix for CVE-2019-14378 merge: slirp: Fix heap overflow in ip_reass on big packet input Signed-off-by: Wolfgang Bumiller --- diff --git a/debian/patches/extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch b/debian/patches/extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch new file mode 100644 index 0000000..5c9a60f --- /dev/null +++ b/debian/patches/extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Sun, 28 Jul 2019 19:11:24 +0200 +Subject: [PATCH] Fix heap overflow in ip_reass on big packet input + +When the first fragment does not fit in the preallocated buffer, q will +already be pointing to the ext buffer, so we mustn't try to update it. + +Signed-off-by: Samuel Thibault +--- + slirp/src/ip_input.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c +index a714fecd58..0ccb78317f 100644 +--- a/slirp/src/ip_input.c ++++ b/slirp/src/ip_input.c +@@ -331,6 +331,8 @@ insert: + q = fp->frag_link.next; + m = dtom(slirp, q); + ++ int was_ext = m->m_flags & M_EXT; ++ + q = (struct ipasfrag *) q->ipf_next; + while (q != (struct ipasfrag*)&fp->frag_link) { + struct mbuf *t = dtom(slirp, q); +@@ -353,7 +355,7 @@ insert: + * the old buffer (in the mbuf), so we must point ip + * into the new buffer. + */ +- if (m->m_flags & M_EXT) { ++ if (!was_ext && m->m_flags & M_EXT) { + int delta = (char *)q - m->m_dat; + q = (struct ipasfrag *)(m->m_ext + delta); + } +-- +2.20.1 + diff --git a/debian/patches/series b/debian/patches/series index 549bc52..ce96303 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,6 +1,7 @@ extra/0001-target-i386-add-MDS-NO-feature.patch extra/0002-target-i386-define-md-clear-bit.patch extra/0003-virtio-balloon-fix-QEMU-4.0-config-size-migration-in.patch +extra/0004-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch