CVE-2018-20124

Debian Bug report logs - #922461
CVE-2018-20124

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2018-20124

Date: Sat, 16 Feb 2019 13:41:52 +0100

Source: qemu
Severity: grave
Tags: security

When rdma was enabled in -3, this also made a fix for CVE-2018-20124 necessary:

https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02822.html
https://git.qemu.org/?p=qemu.git;a=commit;h=0e68373cc2b3a063ce067bc0cc3edaf370752890

Cheers,
        Moritz
		

Message #18 received at 922461@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: Moritz Muehlenhoff <jmm@debian.org>, 922461@bugs.debian.org

Subject: Re: Bug#922461: CVE-2018-20124

Date: Sat, 16 Feb 2019 16:05:15 +0300

Control: notfound -1 1:3.1+dfsg-4

16.02.2019 15:41, Moritz Muehlenhoff wrote:
> Source: qemu
> Severity: grave
> Tags: security
> 
> When rdma was enabled in -3, this also made a fix for CVE-2018-20124 necessary:

Yes indeed.

But since this code has a ton of bugs (not only security) and is generally
quite a bit too "fluxy", I disabled it entirely in -4.

> https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02822.html
> https://git.qemu.org/?p=qemu.git;a=commit;h=0e68373cc2b3a063ce067bc0cc3edaf370752890

Note this is pvrdma, an optimized vmware-like device.
RDMA is in migration, not guest visible.

So I think this can be closed, or at least be made unimportant,
b/c is is only applies to the source code, not to the binary
(code is not compiled into binary).

$ cat hw/rdma/Makefile.objs
ifeq ($(CONFIG_PVRDMA),y)
obj-$(CONFIG_PCI) += rdma_utils.o rdma_backend.o rdma_rm.o
obj-$(CONFIG_PCI) += vmw/pvrdma_dev_ring.o vmw/pvrdma_cmd.o \
                     vmw/pvrdma_qp_ops.o vmw/pvrdma_main.o
endif


Thanks,

/mjt

Send a report that this bug log contains spam.