pool/qemu
SHA256
4
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Accepting request 689894 from Virtualization

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/689894
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/qemu?expand=0&rev=153
This commit is contained in:
Dominique Leuenberger 2019-04-01 10:34:10 +00:00 committed by Git OBS Bridge
commit cf0366af9b
12 changed files with 567 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
0061-slirp-check-sscanf-result-when-emul.patch Normal file
View File

@ -0,0 +1,47 @@
From: William Bowling <will@wbowling.info>
Date: Fri, 1 Mar 2019 21:45:56 +0000
Subject: slirp: check sscanf result when emulating ident
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When emulating ident in tcp_emu, if the strchr checks passed but the
sscanf check failed, two uninitialized variables would be copied and
sent in the reply, so move this code inside the if(sscanf()) clause.
Signed-off-by: William Bowling <will@wbowling.info>
Cc: qemu-stable@nongnu.org
Cc: secalert@redhat.com
Message-Id: <1551476756-25749-1-git-send-email-will@wbowling.info>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
(cherry picked from commit d3222975c7d6cda9e25809dea05241188457b113)
[BR: BSC#1129622 CVE-2019-9824 To pass our checkpatch check, I changed
the patch to use spaces, not tabs, as in the initially proposed]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
slirp/tcp_subr.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
index 7a23ce738c..a6fd8626a8 100644
--- a/slirp/tcp_subr.c
+++ b/slirp/tcp_subr.c
@@ -661,12 +661,12 @@ tcp_emu(struct socket *so, struct mbuf *m)
break;
}
}
+ so_rcv->sb_cc = snprintf(so_rcv->sb_data,
+ so_rcv->sb_datalen,
+ "%d,%d\r\n", n1, n2);
+ so_rcv->sb_rptr = so_rcv->sb_data;
+ so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc;
}
- so_rcv->sb_cc = snprintf(so_rcv->sb_data,
- so_rcv->sb_datalen,
- "%d,%d\r\n", n1, n2);
- so_rcv->sb_rptr = so_rcv->sb_data;
- so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc;
}
m_free(m);
return 0;

153
0062-ppc-add-host-serial-and-host-model-.patch Normal file
View File

@ -0,0 +1,153 @@
From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Mon, 18 Feb 2019 23:43:49 +0530
Subject: ppc: add host-serial and host-model machine attributes
(CVE-2019-8934)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
On ppc hosts, hypervisor shares following system attributes
- /proc/device-tree/system-id
- /proc/device-tree/model
with a guest. This could lead to information leakage and misuse.[*]
Add machine attributes to control such system information exposure
to a guest.
[*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Fix-suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20190218181349.23885-1-ppandit@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
(cherry picked from commit 27461d69a0f108dea756419251acc3ea65198f1b)
[BR: BSC#1126455 CVE-2019-03812]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
hw/ppc/spapr.c | 73 ++++++++++++++++++++++++++++++++++++++----
include/hw/ppc/spapr.h | 2 ++
2 files changed, 69 insertions(+), 6 deletions(-)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 7afd1a175b..d3098d520e 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1244,13 +1244,30 @@ static void *spapr_build_fdt(sPAPRMachineState *spapr,
* Add info to guest to indentify which host is it being run on
* and what is the uuid of the guest
*/
- if (kvmppc_get_host_model(&buf)) {
- _FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
- g_free(buf);
+ if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
+ if (g_str_equal(spapr->host_model, "passthrough")) {
+ /* -M host-model=passthrough */
+ if (kvmppc_get_host_model(&buf)) {
+ _FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
+ g_free(buf);
+ }
+ } else {
+ /* -M host-model=<user-string> */
+ _FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model));
+ }
}
- if (kvmppc_get_host_serial(&buf)) {
- _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
- g_free(buf);
+
+ if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) {
+ if (g_str_equal(spapr->host_serial, "passthrough")) {
+ /* -M host-serial=passthrough */
+ if (kvmppc_get_host_serial(&buf)) {
+ _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
+ g_free(buf);
+ }
+ } else {
+ /* -M host-serial=<user-string> */
+ _FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial));
+ }
}
buf = qemu_uuid_unparse_strdup(&qemu_uuid);
@@ -3031,6 +3048,36 @@ static void spapr_set_vsmt(Object *obj, Visitor *v, const char *name,
visit_type_uint32(v, name, (uint32_t *)opaque, errp);
}
+static char *spapr_get_host_model(Object *obj, Error **errp)
+{
+ sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
+
+ return g_strdup(spapr->host_model);
+}
+
+static void spapr_set_host_model(Object *obj, const char *value, Error **errp)
+{
+ sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
+
+ g_free(spapr->host_model);
+ spapr->host_model = g_strdup(value);
+}
+
+static char *spapr_get_host_serial(Object *obj, Error **errp)
+{
+ sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
+
+ return g_strdup(spapr->host_serial);
+}
+
+static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+{
+ sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
+
+ g_free(spapr->host_serial);
+ spapr->host_serial = g_strdup(value);
+}
+
static void spapr_instance_init(Object *obj)
{
sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
@@ -3067,6 +3114,17 @@ static void spapr_instance_init(Object *obj)
" the host's SMT mode", &error_abort);
object_property_add_bool(obj, "vfio-no-msix-emulation",
spapr_get_msix_emulation, NULL, NULL);
+
+ object_property_add_str(obj, "host-model",
+ spapr_get_host_model, spapr_set_host_model,
+ &error_abort);
+ object_property_set_description(obj, "host-model",
+ "Set host's model-id to use - none|passthrough|string", &error_abort);
+ object_property_add_str(obj, "host-serial",
+ spapr_get_host_serial, spapr_set_host_serial,
+ &error_abort);
+ object_property_set_description(obj, "host-serial",
+ "Set host's system-id to use - none|passthrough|string", &error_abort);
}
static void spapr_machine_finalizefn(Object *obj)
@@ -3961,6 +4019,9 @@ static const TypeInfo spapr_machine_info = {
*/
static void spapr_machine_3_1_instance_options(MachineState *machine)
{
+ sPAPRMachineState *spapr = SPAPR_MACHINE(machine);
+ spapr->host_model = g_strdup("passthrough");
+ spapr->host_serial = g_strdup("passthrough");
}
static void spapr_machine_3_1_class_options(MachineClass *mc)
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 6279711fe8..63692a13bd 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -171,6 +171,8 @@ struct sPAPRMachineState {
/*< public >*/
char *kvm_type;
+ char *host_model;
+ char *host_serial;
const char *icp_type;
int32_t irq_map_nr;

32
0063-i2c-ddc-fix-oob-read.patch Normal file
View File

@ -0,0 +1,32 @@
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 8 Jan 2019 11:23:01 +0100
Subject: i2c-ddc: fix oob read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Suggested-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190108102301.1957-1-kraxel@redhat.com
(cherry picked from commit b05b267840515730dbf6753495d5b7bd8b04ad1c)
[BR: BSC#1125721 CVE-2019-3812]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
hw/i2c/i2c-ddc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/i2c/i2c-ddc.c b/hw/i2c/i2c-ddc.c
index be34fe072c..0a0367ff38 100644
--- a/hw/i2c/i2c-ddc.c
+++ b/hw/i2c/i2c-ddc.c
@@ -56,7 +56,7 @@ static int i2c_ddc_rx(I2CSlave *i2c)
I2CDDCState *s = I2CDDC(i2c);
int value;
- value = s->edid_blob[s->reg];
+ value = s->edid_blob[s->reg % sizeof(s->edid_blob)];
s->reg++;
return value;
}

34
0064-device_tree.c-Don-t-use-load_image.patch Normal file
View File

@ -0,0 +1,34 @@
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 14 Dec 2018 13:30:52 +0000
Subject: device_tree.c: Don't use load_image()
The load_image() function is deprecated, as it does not let the
caller specify how large the buffer to read the file into is.
Instead use load_image_size().
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20181130151712.2312-9-peter.maydell@linaro.org
(cherry picked from commit da885fe1ee8b4589047484bd7fa05a4905b52b17)
[BR: BSC#1130675 CVE-2018-20815]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
device_tree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/device_tree.c b/device_tree.c
index 6d9c9726f6..296278e12a 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -91,7 +91,7 @@ void *load_device_tree(const char *filename_path, int *sizep)
/* First allocate space in qemu for device tree */
fdt = g_malloc0(dt_size);
- dt_file_load_size = load_image(filename_path, fdt);
+ dt_file_load_size = load_image_size(filename_path, fdt, dt_size);
if (dt_file_load_size < 0) {
error_report("Unable to open device tree file '%s'",
filename_path);

167
0065-spapr-Simplify-handling-of-host-ser.patch Normal file
View File

@ -0,0 +1,167 @@
From: David Gibson <david@gibson.dropbear.id.au>
Date: Wed, 27 Mar 2019 13:54:11 +1100
Subject: spapr: Simplify handling of host-serial and host-model values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
27461d69a0f "ppc: add host-serial and host-model machine attributes
(CVE-2019-8934)" introduced 'host-serial' and 'host-model' machine
properties for spapr to explicitly control the values advertised to the
guest in device tree properties with the same names.
The previous behaviour on KVM was to unconditionally populate the device
tree with the real host serial number and model, which leaks possibly
sensitive information about the host to the guest.
To maintain compatibility for old machine types, we allowed those props
to be set to "passthrough" to take the value from the host as before. Or
they could be set to "none" to explicitly omit the device tree items.
Special casing specific values on what's otherwise a user supplied string
is very ugly. So, this patch simplifies things by implementing the
backwards compatibility in a different way: we have a machine class flag
set for the older machines, and we only load the host values into the
device tree if A) they're not set by the user and B) we have that flag set.
This does mean that the "passthrough" functionality is no longer available
with the current machine type. That's ok though: if a user or management
layer really wants the information passed through they can read it
themselves (OpenStack Nova already does something similar for x86).
It also means the user can't explicitly ask for the values to be omitted
on the old machine types. I think that's an acceptable trade-off: if you
care enough about not leaking the host information you can either move to
the new machine type, or use a dummy value for the properties.
For the new machine type, this also removes an odd inconsistency
between running on a POWER and non-POWER (or non-Linux) hosts: if the
host information couldn't be read from where we expect (in the host's
device tree as exposed by Linux), we'd fallback to omitting the guest
device tree items.
While we're there, improve some poorly worded comments, and the help text
for the properties.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Tested-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit 0a794529bd1109aeea0c407784b40a2605e808b9)
[BR: BSC#1126455 CVE-2019-03812]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
hw/ppc/spapr.c | 56 +++++++++++++++---------------------------
include/hw/ppc/spapr.h | 1 +
2 files changed, 21 insertions(+), 36 deletions(-)
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index d3098d520e..b60e1702fc 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1240,38 +1240,8 @@ static void *spapr_build_fdt(sPAPRMachineState *spapr,
_FDT(fdt_setprop_string(fdt, 0, "model", "IBM pSeries (emulated by qemu)"));
_FDT(fdt_setprop_string(fdt, 0, "compatible", "qemu,pseries"));
- /*
- * Add info to guest to indentify which host is it being run on
- * and what is the uuid of the guest
- */
- if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
- if (g_str_equal(spapr->host_model, "passthrough")) {
- /* -M host-model=passthrough */
- if (kvmppc_get_host_model(&buf)) {
- _FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
- g_free(buf);
- }
- } else {
- /* -M host-model=<user-string> */
- _FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model));
- }
- }
-
- if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) {
- if (g_str_equal(spapr->host_serial, "passthrough")) {
- /* -M host-serial=passthrough */
- if (kvmppc_get_host_serial(&buf)) {
- _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
- g_free(buf);
- }
- } else {
- /* -M host-serial=<user-string> */
- _FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial));
- }
- }
-
+ /* Guest UUID & Name*/
buf = qemu_uuid_unparse_strdup(&qemu_uuid);
-
_FDT(fdt_setprop_string(fdt, 0, "vm,uuid", buf));
if (qemu_uuid_set) {
_FDT(fdt_setprop_string(fdt, 0, "system-id", buf));
@@ -1283,6 +1253,21 @@ static void *spapr_build_fdt(sPAPRMachineState *spapr,
qemu_get_vm_name()));
}
+ /* Host Model & Serial Number */
+ if (spapr->host_model) {
+ _FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model));
+ } else if (smc->broken_host_serial_model && kvmppc_get_host_model(&buf)) {
+ _FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
+ g_free(buf);
+ }
+
+ if (spapr->host_serial) {
+ _FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial));
+ } else if (smc->broken_host_serial_model && kvmppc_get_host_serial(&buf)) {
+ _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
+ g_free(buf);
+ }
+
_FDT(fdt_setprop_cell(fdt, 0, "#address-cells", 2));
_FDT(fdt_setprop_cell(fdt, 0, "#size-cells", 2));
@@ -3119,12 +3104,12 @@ static void spapr_instance_init(Object *obj)
spapr_get_host_model, spapr_set_host_model,
&error_abort);
object_property_set_description(obj, "host-model",
- "Set host's model-id to use - none|passthrough|string", &error_abort);
+ "Host model to advertise in guest device tree", &error_abort);
object_property_add_str(obj, "host-serial",
spapr_get_host_serial, spapr_set_host_serial,
&error_abort);
object_property_set_description(obj, "host-serial",
- "Set host's system-id to use - none|passthrough|string", &error_abort);
+ "Host serial number to advertise in guest device tree", &error_abort);
}
static void spapr_machine_finalizefn(Object *obj)
@@ -4019,14 +4004,13 @@ static const TypeInfo spapr_machine_info = {
*/
static void spapr_machine_3_1_instance_options(MachineState *machine)
{
- sPAPRMachineState *spapr = SPAPR_MACHINE(machine);
- spapr->host_model = g_strdup("passthrough");
- spapr->host_serial = g_strdup("passthrough");
}
static void spapr_machine_3_1_class_options(MachineClass *mc)
{
/* Defaults for the latest behaviour inherited from the base class */
+ sPAPRMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+ smc->broken_host_serial_model = true;
}
DEFINE_SPAPR_MACHINE(3_1, "3.1", true);
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 63692a13bd..d3142e0d26 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -105,6 +105,7 @@ struct sPAPRMachineClass {
bool use_ohci_by_default; /* use USB-OHCI instead of XHCI */
bool pre_2_10_has_unused_icps;
bool legacy_irq_allocation;
+ bool broken_host_serial_model; /* present real host info to the guest */
void (*phb_placement)(sPAPRMachineState *spapr, uint32_t index,
uint64_t *buid, hwaddr *pio,

23
qemu-linux-user.changes
View File

@ -1,3 +1,26 @@
-------------------------------------------------------------------
Fri Mar 29 13:13:59 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
* Patches added:
0065-spapr-Simplify-handling-of-host-ser.patch
-------------------------------------------------------------------
Wed Mar 27 16:59:53 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
* Patches added:
0064-device_tree.c-Don-t-use-load_image.patch
-------------------------------------------------------------------
Mon Mar 25 20:45:10 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
* Patches added:
0061-slirp-check-sscanf-result-when-emul.patch
0062-ppc-add-host-serial-and-host-model-.patch
0063-i2c-ddc-fix-oob-read.patch
-------------------------------------------------------------------
Fri Feb 15 22:49:26 UTC 2019 - Bruce Rogers <brogers@suse.com>

10
qemu-linux-user.spec
View File

@ -92,6 +92,11 @@ Patch0057: 0057-s390x-Return-specification-exceptio.patch
Patch0058: 0058-Revert-target-i386-kvm-add-VMX-migr.patch
Patch0059: 0059-memory-Fix-the-memory-region-type-a.patch
Patch0060: 0060-target-i386-sev-Do-not-pin-the-ram-.patch
Patch0061: 0061-slirp-check-sscanf-result-when-emul.patch
Patch0062: 0062-ppc-add-host-serial-and-host-model-.patch
Patch0063: 0063-i2c-ddc-fix-oob-read.patch
Patch0064: 0064-device_tree.c-Don-t-use-load_image.patch
Patch0065: 0065-spapr-Simplify-handling-of-host-ser.patch
# Please do not add QEMU patches manually here.
# Run update_git.sh to regenerate this queue.
ExcludeArch: s390
@ -183,6 +188,11 @@ syscall layer occurs on the native hardware and operating system.
%patch0058 -p1
%patch0059 -p1
%patch0060 -p1
%patch0061 -p1
%patch0062 -p1
%patch0063 -p1
%patch0064 -p1
%patch0065 -p1
%build
./configure \

36
qemu-testsuite.changes
View File

@ -1,3 +1,39 @@
-------------------------------------------------------------------
Fri Mar 29 13:13:57 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Adjust fix for CVE-2019-8934 (bsc#1126455) to match the latest
upstream adjustments for the same. Basically now the security fix
is to provide a dummy host-model and host-serial value, which
overrides getting that value from the host
0065-spapr-Simplify-handling-of-host-ser.patch
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
-------------------------------------------------------------------
Wed Mar 27 16:59:46 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Tweak last spec file change to guard new Requires with conditional
- Fix DOS possibility in device tree processing (CVE-2018-20815
bsc#1130675)
0064-device_tree.c-Don-t-use-load_image.patch
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
-------------------------------------------------------------------
Mon Mar 25 20:45:08 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Remove an unneeded BuildRequires which impacts bsc#1119414 fix
Also add a corresponding Recommends for qemu-tools as part of
this packaging adjustment (bsc#1130484)
- Fix information leak in slirp (CVE-2019-9824 bsc#1129622)
0061-slirp-check-sscanf-result-when-emul.patch
- Add method to specify whether or not to expose certain ppc64 host
information, which can be considered a security issue
(CVE-2019-8934 bsc#1126455)
0062-ppc-add-host-serial-and-host-model-.patch
- Fix OOB memory access and information leak in virtual monitor
interface (CVE-2019-03812 bsc#1125721)
0063-i2c-ddc-fix-oob-read.patch
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
-------------------------------------------------------------------
Fri Mar 8 17:49:54 UTC 2019 - Bruce Rogers <brogers@suse.com>

14
qemu-testsuite.spec
View File

@ -203,6 +203,11 @@ Patch0057: 0057-s390x-Return-specification-exceptio.patch
Patch0058: 0058-Revert-target-i386-kvm-add-VMX-migr.patch
Patch0059: 0059-memory-Fix-the-memory-region-type-a.patch
Patch0060: 0060-target-i386-sev-Do-not-pin-the-ram-.patch
Patch0061: 0061-slirp-check-sscanf-result-when-emul.patch
Patch0062: 0062-ppc-add-host-serial-and-host-model-.patch
Patch0063: 0063-i2c-ddc-fix-oob-read.patch
Patch0064: 0064-device_tree.c-Don-t-use-load_image.patch
Patch0065: 0065-spapr-Simplify-handling-of-host-ser.patch
# Please do not add QEMU patches manually here.
# Run update_git.sh to regenerate this queue.
@ -344,7 +349,6 @@ BuildRequires: libxkbcommon-devel
BuildRequires: lzo-devel
BuildRequires: makeinfo
%if 0%{?suse_version} > 1320
BuildRequires: multipath-tools
BuildRequires: multipath-tools-devel
%endif
BuildRequires: ncurses-devel
@ -843,6 +847,9 @@ Release: 0
Provides: %name:%_libexecdir/qemu-bridge-helper
Requires(pre): permissions
Requires(pre): shadow
%if 0%{?suse_version} > 1320
Recommends: multipath-tools
%endif
Recommends: qemu-block-curl
%if 0%{?with_rbd}
Recommends: qemu-block-rbd
@ -1001,6 +1008,11 @@ This package provides a service file for starting and stopping KSM.
%patch0058 -p1
%patch0059 -p1
%patch0060 -p1
%patch0061 -p1
%patch0062 -p1
%patch0063 -p1
%patch0064 -p1
%patch0065 -p1
pushd roms/seabios
%patch1100 -p1

36
qemu.changes
View File

@ -1,3 +1,39 @@
-------------------------------------------------------------------
Fri Mar 29 13:13:57 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Adjust fix for CVE-2019-8934 (bsc#1126455) to match the latest
upstream adjustments for the same. Basically now the security fix
is to provide a dummy host-model and host-serial value, which
overrides getting that value from the host
0065-spapr-Simplify-handling-of-host-ser.patch
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
-------------------------------------------------------------------
Wed Mar 27 16:59:46 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Tweak last spec file change to guard new Requires with conditional
- Fix DOS possibility in device tree processing (CVE-2018-20815
bsc#1130675)
0064-device_tree.c-Don-t-use-load_image.patch
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
-------------------------------------------------------------------
Mon Mar 25 20:45:08 UTC 2019 - Bruce Rogers <brogers@suse.com>
- Remove an unneeded BuildRequires which impacts bsc#1119414 fix
Also add a corresponding Recommends for qemu-tools as part of
this packaging adjustment (bsc#1130484)
- Fix information leak in slirp (CVE-2019-9824 bsc#1129622)
0061-slirp-check-sscanf-result-when-emul.patch
- Add method to specify whether or not to expose certain ppc64 host
information, which can be considered a security issue
(CVE-2019-8934 bsc#1126455)
0062-ppc-add-host-serial-and-host-model-.patch
- Fix OOB memory access and information leak in virtual monitor
interface (CVE-2019-03812 bsc#1125721)
0063-i2c-ddc-fix-oob-read.patch
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.1
-------------------------------------------------------------------
Fri Mar 8 17:49:54 UTC 2019 - Bruce Rogers <brogers@suse.com>

14
qemu.spec
View File

@ -203,6 +203,11 @@ Patch0057: 0057-s390x-Return-specification-exceptio.patch
Patch0058: 0058-Revert-target-i386-kvm-add-VMX-migr.patch
Patch0059: 0059-memory-Fix-the-memory-region-type-a.patch
Patch0060: 0060-target-i386-sev-Do-not-pin-the-ram-.patch
Patch0061: 0061-slirp-check-sscanf-result-when-emul.patch
Patch0062: 0062-ppc-add-host-serial-and-host-model-.patch
Patch0063: 0063-i2c-ddc-fix-oob-read.patch
Patch0064: 0064-device_tree.c-Don-t-use-load_image.patch
Patch0065: 0065-spapr-Simplify-handling-of-host-ser.patch
# Please do not add QEMU patches manually here.
# Run update_git.sh to regenerate this queue.
@ -344,7 +349,6 @@ BuildRequires: libxkbcommon-devel
BuildRequires: lzo-devel
BuildRequires: makeinfo
%if 0%{?suse_version} > 1320
BuildRequires: multipath-tools
BuildRequires: multipath-tools-devel
%endif
BuildRequires: ncurses-devel
@ -843,6 +847,9 @@ Release: 0
Provides: %name:%_libexecdir/qemu-bridge-helper
Requires(pre): permissions
Requires(pre): shadow
%if 0%{?suse_version} > 1320
Recommends: multipath-tools
%endif
Recommends: qemu-block-curl
%if 0%{?with_rbd}
Recommends: qemu-block-rbd
@ -1001,6 +1008,11 @@ This package provides a service file for starting and stopping KSM.
%patch0058 -p1
%patch0059 -p1
%patch0060 -p1
%patch0061 -p1
%patch0062 -p1
%patch0063 -p1
%patch0064 -p1
%patch0065 -p1
pushd roms/seabios
%patch1100 -p1

5
qemu.spec.in
View File

@ -282,7 +282,6 @@ BuildRequires: libxkbcommon-devel
BuildRequires: lzo-devel
BuildRequires: makeinfo
%if 0%{?suse_version} > 1320
BuildRequires: multipath-tools
BuildRequires: multipath-tools-devel
%endif
BuildRequires: ncurses-devel
@ -781,6 +780,9 @@ Release: 0
Provides: %name:%_libexecdir/qemu-bridge-helper
Requires(pre): permissions
Requires(pre): shadow
%if 0%{?suse_version} > 1320
Recommends: multipath-tools
%endif
Recommends: qemu-block-curl
%if 0%{?with_rbd}
Recommends: qemu-block-rbd
@ -1176,7 +1178,6 @@ make %{?_smp_mflags} -C roms efirom
make -C roms sgabios \
HOSTCC=cc
%if %{force_fit_virtio_pxe_rom}
pushd roms/ipxe
patch -p1 < %{SOURCE301}