On 08/07/2018 02:58 PM, Daniel P. Berrangé wrote: > On Tue, Aug 07, 2018 at 01:52:24PM +0100, Dr. David Alan Gilbert wrote: >> * Peter Maydell ([email protected]) wrote: >>> The data in an mbuf buffer is not necessarily at the start of the >>> allocated buffer. (For instance m_adj() allows data to be trimmed >>> from the start by just advancing the pointer and reducing the length.) >>> This means that the allocated buffer size (m->m_size) and the >>> amount of space from the m_data pointer to the end of the >>> buffer (M_ROOM(m)) are not necessarily the same. >>> >>> Commit 864036e251f54c9 tried to change the m_inc() function from >>> taking the new allocated-buffer-size to taking the new room-size, >>> but forgot to change the initial "do we already have enough space" >>> check. This meant that if we were trying to extend a buffer which >>> had a leading gap between the buffer start and the data, we might >>> incorrectly decide it didn't need to be extended, and then >>> overrun the end of the buffer, causing memory corruption and >>> an eventual crash. >>> >>> Change the "already big enough?" condition from checking the >>> argument against m->m_size to checking against M_ROOM(). >>> This only makes a difference for the callsite in m_cat(); >>> the other three callsites all start with a freshly allocated >>> mbuf from m_get(), which will have m->m_size == M_ROOM(m). >>> >>> Fixes: 864036e251f54c9 > > IIUC, this changeset was a security fix for CVE-2018-11806. > > Given that the fix was flawed and allowed guest to crash the host > with a new buffer overrun, it seems we need to get a new CVE allocated > too.
But 864036e251f54c9 was never part of an official QEMU release, was it? Or did it go into a stable release already? If not, I think you simply need both patches to fix the CVE instead. Thomas
