-
- Downloads
qemu: fix CVE-2023-3019
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. CVE-2023-3019-0002 is the CVE fix and CVE-2023-3019-0001 is dependent CVE fix. fix indent issue in qemu.inc file. CVE-2023-3019 patch required Mem ReenttranceyGuard structure definition, it's defined in commit: https://github.com/qemu/qemu/commit/a2e1753b8054344f32cf94f31c6399a58794a380 but the patch is causing errors: Failed: qemux86 does not shutdown within timeout(120) so backported only required structure definition. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-3019 Upstream patches: https://github.com/qemu/qemu/commit/7d0fefdf81f5973334c344f6b8e1896c309dff66 https://github.com/qemu/qemu/commit/3c0463a650008aec7de29cf84540652730510921 (From OE-Core rev: 3782e1b21882ffc5e4cc466418e066179470241e) Signed-off-by:Yogita Urade <yogita.urade@windriver.com> Signed-off-by:
Steve Sakoman <steve@sakoman.com>
Showing
- meta/recipes-devtools/qemu/qemu.inc 10 additions, 8 deletionsmeta/recipes-devtools/qemu/qemu.inc
- meta/recipes-devtools/qemu/qemu/CVE-2023-3019-0001.patch 622 additions, 0 deletionsmeta/recipes-devtools/qemu/qemu/CVE-2023-3019-0001.patch
- meta/recipes-devtools/qemu/qemu/CVE-2023-3019-0002.patch 91 additions, 0 deletionsmeta/recipes-devtools/qemu/qemu/CVE-2023-3019-0002.patch
Loading
Please register or sign in to comment