Dario Faggioli
6749a6e9ce
- Fix the following bugs: - bsc#1198037, CVE-2021-4207 - bsc#1198038, CVE-2022-0216 - bsc#1201367, CVE-2022-35414 - bsc#1198035, CVE-2021-4206 - bsc#1198712, CVE-2022-26354 - bsc#1198711, CVE-2022-26353 * Patches added: display-qxl-render-fix-race-condition-in.patch scsi-lsi53c895a-fix-use-after-free-in-ls.patch softmmu-Always-initialize-xlat-in-addres.patch ui-cursor-fix-integer-overflow-in-cursor.patch vhost-vsock-detach-the-virqueue-element-.patch virtio-net-fix-map-leaking-on-error-duri.patch OBS-URL: https://build.opensuse.org/request/show/989442 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=725
37 lines
1.4 KiB
Diff
37 lines
1.4 KiB
Diff
From: Mauro Matteo Cascella <mcascell@redhat.com>
|
|
Date: Tue, 5 Jul 2022 22:05:43 +0200
|
|
Subject: scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
|
|
|
|
Git-commit: 6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8
|
|
References: bsc#1198038, CVE-2022-0216
|
|
|
|
Set current_req->req to NULL to prevent reusing a free'd buffer in case of
|
|
repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch.
|
|
|
|
Fixes: CVE-2022-0216
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
|
|
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
|
|
Reviewed-by: Thomas Huth <thuth@redhat.com>
|
|
Message-Id: <20220705200543.2366809-1-mcascell@redhat.com>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Signed-off-by: Dario Faggioli <dfaggioli@suse.com>
|
|
---
|
|
hw/scsi/lsi53c895a.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
|
|
index 85e907a7854a8aeaa812978675cd..8033cf05023de397e91a0a121449 100644
|
|
--- a/hw/scsi/lsi53c895a.c
|
|
+++ b/hw/scsi/lsi53c895a.c
|
|
@@ -1029,8 +1029,9 @@ static void lsi_do_msgout(LSIState *s)
|
|
case 0x0d:
|
|
/* The ABORT TAG message clears the current I/O process only. */
|
|
trace_lsi_do_msgout_abort(current_tag);
|
|
- if (current_req) {
|
|
+ if (current_req && current_req->req) {
|
|
scsi_req_cancel(current_req->req);
|
|
+ current_req->req = NULL;
|
|
}
|
|
lsi_disconnect(s);
|
|
break;
|