diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2015-07-08 07:58:45 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2015-07-08 07:59:26 +0000 |
| commit | 786a06d135bec56c5f93b9b5a0099cb34957f1da (patch) | |
| tree | 7d500add80f800a825ef9a4edd5509e96411b70b /main/qemu | |
| parent | 1c9a2c4a4368247649ca29b0ae63ced9dd3bf402 (diff) | |
| download | aports-786a06d135bec56c5f93b9b5a0099cb34957f1da.tar.bz2 aports-786a06d135bec56c5f93b9b5a0099cb34957f1da.tar.xz | |
main/qemu: security fix for CVE-2015-4037
ref #4328
Diffstat (limited to 'main/qemu')
| -rw-r--r-- | main/qemu/APKBUILD | 4 | ||||
| -rw-r--r-- | main/qemu/CVE-2015-4037.patch | 50 |
2 files changed, 54 insertions, 0 deletions
diff --git a/main/qemu/APKBUILD b/main/qemu/APKBUILD index 1ee54abe31..f02c4fd5b1 100644 --- a/main/qemu/APKBUILD +++ b/main/qemu/APKBUILD @@ -96,6 +96,7 @@ source="http://wiki.qemu-project.org/download/qemu-$pkgver.tar.bz2 fix-sigevent-and-sigval_t.patch CVE-2015-3456.patch + CVE-2015-4037.patch qemu-guest-agent.confd qemu-guest-agent.initd @@ -295,6 +296,7 @@ d364208c4847ad2baeb237900befecd1 0006-linux-user-signal.c-define-__SIGRTMIN-MAX bc5f2e41ed3b6d6d30b672adab82e3e1 musl-F_SHLCK-and-F_EXLCK.patch 9afbd6c9586229ce64275f012d665e2a fix-sigevent-and-sigval_t.patch 5e8a68940c4e0267e795a6ddd144e00e CVE-2015-3456.patch +97045abdf8d0543691e52f9fdf0c8d52 CVE-2015-4037.patch 1663bc6977f6886a58394155b1bf3676 qemu-guest-agent.confd 4cb15a1c3de2691dd65842f2325dfe22 qemu-guest-agent.initd 66660f143235201249dc0648b39b86ee 80-kvm.rules" @@ -304,6 +306,7 @@ af35304b165622a53f7557b59ffd8da5030f5fd444e669c862f9410131f3b987 0001-elfload-l eefd597197223899d3b12d8274af493153e270fd06ea8622e33d6eaeae063d40 musl-F_SHLCK-and-F_EXLCK.patch 9abdf3410dea742cac3552363950c8a7fbcec8dd2bfd68e3c417a284f4e702f5 fix-sigevent-and-sigval_t.patch de69a47daf292fd0cc01c925a23c9fadbac0fb60c322bf89260cccceb47ca204 CVE-2015-3456.patch +6bb3f4bb71716bdde8ff417b76ceb4cee336ae93a65b2ae1db15406f382c0299 CVE-2015-4037.patch d84e53a94584f37f3bd1b21f44077b5de0d07094c6729f26ae20ab1f7b9cc298 qemu-guest-agent.confd 91f5ba66b56bb9a3e0d134de3ea756794d5f09fe8a14a4b0d3d95f69a9245c60 qemu-guest-agent.initd 37f666f1cdb7d8a62171de69b531681dcb0fba74236729dac8b6c019232eba84 80-kvm.rules" @@ -313,6 +316,7 @@ ec84b27648c01c6e58781295dcd0c2ff8e5a635f9836ef50c1da5d0ed125db1afc4cb5b01cb97606 5de10f7e8abae16d1d7521e5ca1bfb62a8f295b324bea84f122f882b7b9354c21e5a00b20a1c5484c1b737b937e53c4ca6979e55705522f0779a5669725369f5 musl-F_SHLCK-and-F_EXLCK.patch e3f006c28318669356cd5b778f26774f06b0a40a4ac852573379df63efcc8276869958faec16797a38bf96c6061dfc040309e462d8559984f67eaf4af701ca1a fix-sigevent-and-sigval_t.patch 81485e26e30314b075a154cbce841fa3b803b70d8539a5ce00e57ec2020ab801d88c35631805811d003505dfd1909a5b70307fdbd8a192986f53143669465bd8 CVE-2015-3456.patch +8dc68c2f511a28b0c1896b89922fab8e31dea4eefe18a69e6c068dd799cfc5a5a8b2ed8c3f5d17584932ddb9a2bf72d72fdaaf19c2129babf9a8e8f4ce150659 CVE-2015-4037.patch d90c034cae3f9097466854ed1a9f32ab4b02089fcdf7320e8f4da13b2b1ff65067233f48809911485e4431d7ec1a22448b934121bc9522a2dc489009e87e2b1f qemu-guest-agent.confd 69457d757909b990f4fdfaef621696e5a5d287b42bc58e553cb52d85191788a269e91c0475bfb7223d3a9120c19cdf4d749b4d54013a644f33d0551517cdf094 qemu-guest-agent.initd 9b7a89b20fcf737832cb7b4d5dc7d8301dd88169cbe5339eda69fbb51c2e537d8cb9ec7cf37600899e734209e63410d50d0821bce97e401421db39c294d97be2 80-kvm.rules" diff --git a/main/qemu/CVE-2015-4037.patch b/main/qemu/CVE-2015-4037.patch new file mode 100644 index 0000000000..fb36234531 --- /dev/null +++ b/main/qemu/CVE-2015-4037.patch @@ -0,0 +1,50 @@ +From: Michael Tokarev <mjt@tls.msk.ru> +Date: Thu, 28 May 2015 14:12:26 +0300 +Subject: [PATCH] slirp: use less predictable directory name in /tmp for smb + config (CVE-2015-4037) + +In this version I used mkdtemp(3) which is: + + _BSD_SOURCE + || /* Since glibc 2.10: */ + (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700) + +(POSIX.1-2008), so should be available on systems we care about. + +While at it, reset the resulting directory name within smb structure +on error so cleanup function wont try to remove directory which we +failed to create. + +Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> +Reviewed-by: Markus Armbruster <armbru@redhat.com> +(cherry picked from commit 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3) +--- + net/slirp.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/slirp.c b/net/slirp.c +index 9bbed74..3090c10 100644 +--- a/net/slirp.c ++++ b/net/slirp.c +@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s) + static int slirp_smb(SlirpState* s, const char *exported_dir, + struct in_addr vserver_addr) + { +- static int instance; + char smb_conf[128]; + char smb_cmdline[128]; + struct passwd *passwd; +@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, const char *exported_dir, + return -1; + } + +- snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d", +- (long)getpid(), instance++); +- if (mkdir(s->smb_dir, 0700) < 0) { ++ snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX"); ++ if (!mkdtemp(s->smb_dir)) { + error_report("could not create samba server dir '%s'", s->smb_dir); ++ s->smb_dir[0] = 0; + return -1; + } + snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf"); |