Control: notfound -1 1:3.1+dfsg-4
16.02.2019 15:41, Moritz Muehlenhoff wrote:
Source: qemu
Severity: grave
Tags: security
When rdma was enabled in -3, this also made a fix for CVE-2018-20124 necessary:
Yes indeed.
But since this code has a ton of bugs (not only security) and is generally
quite a bit too "fluxy", I disabled it entirely in -4.
https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02822.html
https://git.qemu.org/?p=qemu.git;a=commit;h=0e68373cc2b3a063ce067bc0cc3edaf370752890
Note this is pvrdma, an optimized vmware-like device.
RDMA is in migration, not guest visible.
So I think this can be closed, or at least be made unimportant,
b/c is is only applies to the source code, not to the binary
(code is not compiled into binary).
$ cat hw/rdma/Makefile.objs
ifeq ($(CONFIG_PVRDMA),y)
obj-$(CONFIG_PCI) += rdma_utils.o rdma_backend.o rdma_rm.o
obj-$(CONFIG_PCI) += vmw/pvrdma_dev_ring.o vmw/pvrdma_cmd.o \
vmw/pvrdma_qp_ops.o vmw/pvrdma_main.o
endif
Thanks,
/mjt
