diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/CVE-2022-0216-1.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/CVE-2022-0216-1.patch | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2022-0216-1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2022-0216-1.patch new file mode 100644 index 0000000000..6a7ce0e26c --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2022-0216-1.patch | |||
@@ -0,0 +1,42 @@ | |||
1 | From 6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8 Mon Sep 17 00:00:00 2001 | ||
2 | From: Mauro Matteo Cascella <mcascell@redhat.com> | ||
3 | Date: Tue, 5 Jul 2022 22:05:43 +0200 | ||
4 | Subject: [PATCH] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout | ||
5 | (CVE-2022-0216) | ||
6 | |||
7 | Set current_req->req to NULL to prevent reusing a free'd buffer in case of | ||
8 | repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch. | ||
9 | |||
10 | Fixes: CVE-2022-0216 | ||
11 | Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 | ||
12 | Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> | ||
13 | Reviewed-by: Thomas Huth <thuth@redhat.com> | ||
14 | Message-Id: <20220705200543.2366809-1-mcascell@redhat.com> | ||
15 | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | ||
16 | |||
17 | https://gitlab.com/qemu-project/qemu/-/commit/6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8 | ||
18 | CVE: CVE-2022-0216 | ||
19 | Upstream-Status: Backport | ||
20 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
21 | --- | ||
22 | hw/scsi/lsi53c895a.c | 3 ++- | ||
23 | 1 file changed, 2 insertions(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c | ||
26 | index c8773f73f7..99ea42d49b 100644 | ||
27 | --- a/hw/scsi/lsi53c895a.c | ||
28 | +++ b/hw/scsi/lsi53c895a.c | ||
29 | @@ -1028,8 +1028,9 @@ static void lsi_do_msgout(LSIState *s) | ||
30 | case 0x0d: | ||
31 | /* The ABORT TAG message clears the current I/O process only. */ | ||
32 | trace_lsi_do_msgout_abort(current_tag); | ||
33 | - if (current_req) { | ||
34 | + if (current_req && current_req->req) { | ||
35 | scsi_req_cancel(current_req->req); | ||
36 | + current_req->req = NULL; | ||
37 | } | ||
38 | lsi_disconnect(s); | ||
39 | break; | ||
40 | -- | ||
41 | GitLab | ||
42 | |||