1 |
commit: e5ca277abf3b2bbdb296b36229892ae8f332b4c0 |
2 |
Author: Aric Belsito <lluixhi <AT> gmail <DOT> com> |
3 |
AuthorDate: Thu Jul 27 17:56:38 2017 +0000 |
4 |
Commit: Aric Belsito <lluixhi <AT> gmail <DOT> com> |
5 |
CommitDate: Thu Jul 27 17:56:38 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/musl.git/commit/?id=e5ca277a |
7 |
|
8 |
app-emulation/qemu: sync with tree |
9 |
|
10 |
app-emulation/qemu/Manifest | 3 +- |
11 |
.../qemu/files/qemu-2.9.0-CVE-2017-7493.patch | 174 --------------------- |
12 |
app-emulation/qemu/qemu-2.9.0-r56.ebuild | 1 - |
13 |
3 files changed, 1 insertion(+), 177 deletions(-) |
14 |
|
15 |
diff --git a/app-emulation/qemu/Manifest b/app-emulation/qemu/Manifest |
16 |
index 5fe223b..e4a3f79 100644 |
17 |
--- a/app-emulation/qemu/Manifest |
18 |
+++ b/app-emulation/qemu/Manifest |
19 |
@@ -9,7 +9,6 @@ AUX qemu-2.9.0-CVE-2017-10664.patch 1613 SHA256 5941cc41f0c02b185be3f6ba450f155d |
20 |
AUX qemu-2.9.0-CVE-2017-10806.patch 1450 SHA256 ef884e2ed3adb618273af1d036ed0c7e3a09599e3d042080bb4b5014c6bc54d7 SHA512 38fea2c1a2a5a224585a07a028a8c4cfc1bec4d943e85c13e01228062bf306a502b0948270863b226bc974832e3af18158904fbfc08ccdf1f72f06e7830780d5 WHIRLPOOL f02fb957016af684dc894f93ec0b7dcca3febb8d37882aae1e17d2aca9948e200a013ae467cb54c5555e76c73f124a37c95fde189a4492d88322802d8160310c |
21 |
AUX qemu-2.9.0-CVE-2017-11334.patch 1362 SHA256 bc2f3a50ad174e5453d0e4d1e14e9723b316e2339dc25ff31e27060ee13242bb SHA512 422296269ec29b3313c984947ac48b7179ce8e169131624d316589a621778f846b883e76cdfba50c62dc63ab5fede0ad0292704c1ca1cc9e1e7b3b01a153b8c8 WHIRLPOOL 504cf6b2ebfb11bf1471f920d101df28df59f1a585eac31ac278a366f2b769386bc7d100aa8386b3f8f45d5f5f700aa6625be3192eb4f1f3b77e69c6684cf74f |
22 |
AUX qemu-2.9.0-CVE-2017-11434.patch 912 SHA256 e8be3cb9261f8735ff2a50fb8b79ccfea85456c7a2e5a5702fcc5339463dc05a SHA512 db95d9459b9669e0981195fe15f16c4e74d5f00c03e1ce5e33541e005260e77fa114b1b3f30bc06d80b723a6361b704fb58709b25773c168c8aa8f5f96580ac9 WHIRLPOOL c68e25024ab3c1d01e5b53d0a7b1591110b96d78079bc940ec28da2e2770dac6b1f9bbaaeb97c88ea0e1b46db886f7035d81bde582750e560d136916ecdab8a2 |
23 |
-AUX qemu-2.9.0-CVE-2017-7493.patch 5656 SHA256 77462d39e811e58d3761523a6c580485bdfca0e74adbd10cf24c254e0ece262a SHA512 2b01f2878c98e77997b645ba80e69b5db398ef1e8f2b66344818d3c9af35dd66d49041ef9ee8aa152bf3e94970b4db282cf53909cb13b2532bc0a104251b2e81 WHIRLPOOL 23c788c5a78e126a61bd277e9fa1511cc71b8fbdc83a5bf319c5fc424219cbcceefad737844e45c11a76e047f8a49853d0a85b267f24f7b23bb7276d0edf0451 |
24 |
AUX qemu-2.9.0-CVE-2017-7539.patch 22018 SHA256 523d41e08a2aab888e3e63b4dda6a19e535fe6fba2bf08b6ead06498ca923f29 SHA512 5c81488aeae78307bee551a3a037f3b9cf55971a17c5df17f89f31224bdfa0a5e79141341314546256bffe542b781ad25151c54340a63c766086a578e5465825 WHIRLPOOL 085fc7e7d40c803a3caf15cdee77ce553b385919678ecf4bbcc3f532af5e482ca804a167af43e4f393da93aed88285690d84a3054c7f0df61d603d0046029dbc |
25 |
AUX qemu-2.9.0-CVE-2017-8112.patch 696 SHA256 a4dcc2a94749a5c20ef38d4c7ce13cd1ffe46017c77eea29ced0bec5c232e6aa SHA512 840f5270332729e0149a4705bae5fcc16e9503a995d6bfa5033904a544add337ca8ccb1d2a36bb57cc198f6354f5253403f1c4f04cbd18c08b4e1a9d6af9e07f WHIRLPOOL 1ba4e75fdd0c767254c85754612da9e8ff9ba2e7ea0811f723844bec190946805cd59db83f347a3dea4296d2b58d2df4a8d99a492335ba818824348bcebdd556 |
26 |
AUX qemu-2.9.0-CVE-2017-8309.patch 595 SHA256 8231747fe4d9c97392fe44b117caccd07d320313dc27fad17ac658122113ced9 SHA512 4415c36acb4f0594de7fe0de2b669d03d6b54ae44eb7f1f285c36223a02cca887b57db27a43ab1cc2e7e193ee5bce2748f9d2056aa925e0cc8f2133e67168a74 WHIRLPOOL af4c5e9763a0e114e554a1c8be99ea79da0b634fdc9d87922c7713187f1f904bfcce103648d549bbb190e92443664dbb9bd7592d8137f2337be0f4b22d1f9bd1 |
27 |
@@ -23,5 +22,5 @@ AUX qemu-binfmt.initd.head 1445 SHA256 a9b4b1d1ffa82d572c01f14ebfbafb4b3a4c2eb5c |
28 |
AUX qemu-binfmt.initd.tail 245 SHA256 1b765f5212946b73b8e4d92f64d34a9d2e358ef541c02164f6d6dd93cb15e1e7 SHA512 bcca16805f8380d52cc591ea3d65a8f6e5de456730618f6aee301510edb75d235a22d4d7aeed224882210392840adb403eb53234b6cb76a4cb24533852a8b737 WHIRLPOOL 41ddd1751101646e700a6fe4ef879bd4149d646a801f97e40534051895697dcbded06a1edda51457a0d624fbf68442c3e57178a3ee8e683e35368b88d10ba4a4 |
29 |
DIST qemu-2.9.0.tar.bz2 28720490 SHA256 00bfb217b1bb03c7a6c3261b819cfccbfb5a58e3e2ceff546327d271773c6c14 SHA512 4b28966eec0ca44681e35fcfb64a4eaef7c280b8d65c91d03f2efa37f76278fd8c1680e5798c7a30dbfcc8f3c05f4a803f48b8a2dfec3a4181bac079b2a5e422 WHIRLPOOL d79fe89eb271a56aee0cbd328e5f96999176b711afb5683d164b7b99d91e6dd2bfaf6e2ff4cd820a941c94f28116765cb07ffd5809d75c2f9654a67d56bfc0c1 |
30 |
EBUILD qemu-2.9.0-r2.ebuild 22065 SHA256 45015103d32a318241da3d34c7340786571b65dc580f8493853c35e0ad5541ec SHA512 7b69c749172677046a101778ba2d8078bf8f5ccedc2d3c6767a2096838f8b80d0519bb798f23e7229fec04ca0c6c4c96caf7d07983ca2aca8d77e86b4f2ed229 WHIRLPOOL ebbf728a67a6f67ce2d40ac72cc95e27e46133e522d70a0e6d91525df7af048d2d1dfbb3e9534e4871882f5fe01749e3f749662414f802569c2f40ac66450afa |
31 |
-EBUILD qemu-2.9.0-r56.ebuild 24010 SHA256 4185ac27c271ca09d383907cf914c020ba5f9614d5c3901d12e82d4069e0090f SHA512 fab143169a3c25fcf7b2532ec10c651c8b1c1875ea8cb0daa4ae29e153c9609ebc75184df1584944eadb541db76e931ff121866dcde58f3e25e29ad9eadc0a24 WHIRLPOOL 44d3f1fc2f01e61287508580beeacc9c1e1c709b6d19347f69a33ea3202ad7e8dd035d3df948dec11b3a62564a23a41a5c5a1e6faa1e2bde5f31d0ec9c02eb9b |
32 |
+EBUILD qemu-2.9.0-r56.ebuild 23949 SHA256 29ec70d1fb1a0bc116b712cb5bad5cdc8039d03bfc10af26d5cb0f15dbac3230 SHA512 6d7c57c85acd8627105e88fdda2ed07ed5a2724b01b31e8fe601eeed74d78197e8e3ae50079688a8c8dd7f771017f45968eff4d1e8e976fae4ce5c7dfec891e0 WHIRLPOOL 7958cc33f46924d50f2790a25a66ec4a3e93326e7b0c1f4625e13bf85060102fa4f4989bcd4814517e1c5b7390df8c3b31b0f045970da7a93cf558cc5411ac5f |
33 |
MISC metadata.xml 3794 SHA256 149f7bc9927e13bbf7355972e85df6f9f198dd17fb575a7e516817d6a88018fb SHA512 10f130f225b90dacf8262247d795a247abfdcbf3ad5fbe0693e8d4db79f755984f690cb150a7eb5a8e5d669ce404145c4fbb6b200d6362319be74759fd78b6d3 WHIRLPOOL 6a5e88caeb64387f619a19fecb55c39ccf3c8dcd360523e8d61b80051001c02fe81432c55e40b3f360295b35e9f5a1f707c570baf95cad06d18c4cd484da0ceb |
34 |
|
35 |
diff --git a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-7493.patch b/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-7493.patch |
36 |
deleted file mode 100644 |
37 |
index 346e771..0000000 |
38 |
--- a/app-emulation/qemu/files/qemu-2.9.0-CVE-2017-7493.patch |
39 |
+++ /dev/null |
40 |
@@ -1,174 +0,0 @@ |
41 |
-From 7a95434e0ca8a037fd8aa1a2e2461f92585eb77b Mon Sep 17 00:00:00 2001 |
42 |
-From: Greg Kurz <groug@××××.org> |
43 |
-Date: Fri, 5 May 2017 14:48:08 +0200 |
44 |
-Subject: [PATCH] 9pfs: local: forbid client access to metadata (CVE-2017-7493) |
45 |
- |
46 |
-When using the mapped-file security mode, we shouldn't let the client mess |
47 |
-with the metadata. The current code already tries to hide the metadata dir |
48 |
-from the client by skipping it in local_readdir(). But the client can still |
49 |
-access or modify it through several other operations. This can be used to |
50 |
-escalate privileges in the guest. |
51 |
- |
52 |
-Affected backend operations are: |
53 |
-- local_mknod() |
54 |
-- local_mkdir() |
55 |
-- local_open2() |
56 |
-- local_symlink() |
57 |
-- local_link() |
58 |
-- local_unlinkat() |
59 |
-- local_renameat() |
60 |
-- local_rename() |
61 |
-- local_name_to_path() |
62 |
- |
63 |
-Other operations are safe because they are only passed a fid path, which |
64 |
-is computed internally in local_name_to_path(). |
65 |
- |
66 |
-This patch converts all the functions listed above to fail and return |
67 |
-EINVAL when being passed the name of the metadata dir. This may look |
68 |
-like a poor choice for errno, but there's no such thing as an illegal |
69 |
-path name on Linux and I could not think of anything better. |
70 |
- |
71 |
-This fixes CVE-2017-7493. |
72 |
- |
73 |
-Reported-by: Leo Gaspard <leo@×××××××.io> |
74 |
-Signed-off-by: Greg Kurz <groug@××××.org> |
75 |
-Reviewed-by: Eric Blake <eblake@××××××.com> |
76 |
---- |
77 |
- hw/9pfs/9p-local.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- |
78 |
- 1 file changed, 56 insertions(+), 2 deletions(-) |
79 |
- |
80 |
-diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c |
81 |
-index f3ebca4f7a..a2486566af 100644 |
82 |
---- a/hw/9pfs/9p-local.c |
83 |
-+++ b/hw/9pfs/9p-local.c |
84 |
-@@ -452,6 +452,11 @@ static off_t local_telldir(FsContext *ctx, V9fsFidOpenState *fs) |
85 |
- return telldir(fs->dir.stream); |
86 |
- } |
87 |
- |
88 |
-+static bool local_is_mapped_file_metadata(FsContext *fs_ctx, const char *name) |
89 |
-+{ |
90 |
-+ return !strcmp(name, VIRTFS_META_DIR); |
91 |
-+} |
92 |
-+ |
93 |
- static struct dirent *local_readdir(FsContext *ctx, V9fsFidOpenState *fs) |
94 |
- { |
95 |
- struct dirent *entry; |
96 |
-@@ -465,8 +470,8 @@ again: |
97 |
- if (ctx->export_flags & V9FS_SM_MAPPED) { |
98 |
- entry->d_type = DT_UNKNOWN; |
99 |
- } else if (ctx->export_flags & V9FS_SM_MAPPED_FILE) { |
100 |
-- if (!strcmp(entry->d_name, VIRTFS_META_DIR)) { |
101 |
-- /* skp the meta data directory */ |
102 |
-+ if (local_is_mapped_file_metadata(ctx, entry->d_name)) { |
103 |
-+ /* skip the meta data directory */ |
104 |
- goto again; |
105 |
- } |
106 |
- entry->d_type = DT_UNKNOWN; |
107 |
-@@ -559,6 +564,12 @@ static int local_mknod(FsContext *fs_ctx, V9fsPath *dir_path, |
108 |
- int err = -1; |
109 |
- int dirfd; |
110 |
- |
111 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
112 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
113 |
-+ errno = EINVAL; |
114 |
-+ return -1; |
115 |
-+ } |
116 |
-+ |
117 |
- dirfd = local_opendir_nofollow(fs_ctx, dir_path->data); |
118 |
- if (dirfd == -1) { |
119 |
- return -1; |
120 |
-@@ -605,6 +616,12 @@ static int local_mkdir(FsContext *fs_ctx, V9fsPath *dir_path, |
121 |
- int err = -1; |
122 |
- int dirfd; |
123 |
- |
124 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
125 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
126 |
-+ errno = EINVAL; |
127 |
-+ return -1; |
128 |
-+ } |
129 |
-+ |
130 |
- dirfd = local_opendir_nofollow(fs_ctx, dir_path->data); |
131 |
- if (dirfd == -1) { |
132 |
- return -1; |
133 |
-@@ -694,6 +711,12 @@ static int local_open2(FsContext *fs_ctx, V9fsPath *dir_path, const char *name, |
134 |
- int err = -1; |
135 |
- int dirfd; |
136 |
- |
137 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
138 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
139 |
-+ errno = EINVAL; |
140 |
-+ return -1; |
141 |
-+ } |
142 |
-+ |
143 |
- /* |
144 |
- * Mark all the open to not follow symlinks |
145 |
- */ |
146 |
-@@ -752,6 +775,12 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath, |
147 |
- int err = -1; |
148 |
- int dirfd; |
149 |
- |
150 |
-+ if (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE && |
151 |
-+ local_is_mapped_file_metadata(fs_ctx, name)) { |
152 |
-+ errno = EINVAL; |
153 |
-+ return -1; |
154 |
-+ } |
155 |
-+ |
156 |
- dirfd = local_opendir_nofollow(fs_ctx, dir_path->data); |
157 |
- if (dirfd == -1) { |
158 |
- return -1; |
159 |
-@@ -826,6 +855,12 @@ static int local_link(FsContext *ctx, V9fsPath *oldpath, |
160 |
- int ret = -1; |
161 |
- int odirfd, ndirfd; |
162 |
- |
163 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
164 |
-+ local_is_mapped_file_metadata(ctx, name)) { |
165 |
-+ errno = EINVAL; |
166 |
-+ return -1; |
167 |
-+ } |
168 |
-+ |
169 |
- odirfd = local_opendir_nofollow(ctx, odirpath); |
170 |
- if (odirfd == -1) { |
171 |
- goto out; |
172 |
-@@ -1096,6 +1131,12 @@ static int local_lremovexattr(FsContext *ctx, V9fsPath *fs_path, |
173 |
- static int local_name_to_path(FsContext *ctx, V9fsPath *dir_path, |
174 |
- const char *name, V9fsPath *target) |
175 |
- { |
176 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
177 |
-+ local_is_mapped_file_metadata(ctx, name)) { |
178 |
-+ errno = EINVAL; |
179 |
-+ return -1; |
180 |
-+ } |
181 |
-+ |
182 |
- if (dir_path) { |
183 |
- v9fs_path_sprintf(target, "%s/%s", dir_path->data, name); |
184 |
- } else if (strcmp(name, "/")) { |
185 |
-@@ -1116,6 +1157,13 @@ static int local_renameat(FsContext *ctx, V9fsPath *olddir, |
186 |
- int ret; |
187 |
- int odirfd, ndirfd; |
188 |
- |
189 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
190 |
-+ (local_is_mapped_file_metadata(ctx, old_name) || |
191 |
-+ local_is_mapped_file_metadata(ctx, new_name))) { |
192 |
-+ errno = EINVAL; |
193 |
-+ return -1; |
194 |
-+ } |
195 |
-+ |
196 |
- odirfd = local_opendir_nofollow(ctx, olddir->data); |
197 |
- if (odirfd == -1) { |
198 |
- return -1; |
199 |
-@@ -1206,6 +1254,12 @@ static int local_unlinkat(FsContext *ctx, V9fsPath *dir, |
200 |
- int ret; |
201 |
- int dirfd; |
202 |
- |
203 |
-+ if (ctx->export_flags & V9FS_SM_MAPPED_FILE && |
204 |
-+ local_is_mapped_file_metadata(ctx, name)) { |
205 |
-+ errno = EINVAL; |
206 |
-+ return -1; |
207 |
-+ } |
208 |
-+ |
209 |
- dirfd = local_opendir_nofollow(ctx, dir->data); |
210 |
- if (dirfd == -1) { |
211 |
- return -1; |
212 |
--- |
213 |
-2.13.0 |
214 |
- |
215 |
|
216 |
diff --git a/app-emulation/qemu/qemu-2.9.0-r56.ebuild b/app-emulation/qemu/qemu-2.9.0-r56.ebuild |
217 |
index ad2e5f7..9ccb645 100644 |
218 |
--- a/app-emulation/qemu/qemu-2.9.0-r56.ebuild |
219 |
+++ b/app-emulation/qemu/qemu-2.9.0-r56.ebuild |
220 |
@@ -213,7 +213,6 @@ PATCHES=( |
221 |
"${FILESDIR}"/${PN}-2.9.0-CVE-2017-9503-2.patch |
222 |
"${FILESDIR}"/${PN}-2.9.0-CVE-2017-10664.patch # bug 623016 |
223 |
"${FILESDIR}"/${PN}-2.9.0-CVE-2017-10806.patch # bug 624088 |
224 |
- "${FILESDIR}"/${PN}-2.9.0-CVE-2017-7539.patch # bug 625850 |
225 |
) |
226 |
|
227 |
STRIP_MASK="/usr/share/qemu/palcode-clipper" |