From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34655) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XoUTn-0007EY-FA for qemu-devel@nongnu.org; Wed, 12 Nov 2014 04:44:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XoUTg-00084u-KA for qemu-devel@nongnu.org; Wed, 12 Nov 2014 04:44:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:43873) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XoUTg-00084c-CM for qemu-devel@nongnu.org; Wed, 12 Nov 2014 04:44:40 -0500 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id sAC9idsS007536 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Wed, 12 Nov 2014 04:44:39 -0500 Date: Wed, 12 Nov 2014 11:44:35 +0200 From: "Michael S. Tsirkin" Message-ID: <1415785203-26938-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [PATCH 0/4] migration: fix CVE-2014-7840 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: dgilbert@redhat.com, quintela@redhat.com This patchset fixes CVE-2014-7840: invalid migration stream can cause arbitrary qemu memory overwrite. First patch includes the minimal fix for the issue. Follow-up patches on top add extra checking to reduce the chance this kind of bug recurs. Note: these are already (tentatively-pending review) queued in my tree, so only review/ack is necessary. Michael S. Tsirkin (4): migration: fix parameter validation on ram load exec: add wrapper for host pointer access cpu: assert host pointer offset within block cpu: verify that block->host is set include/exec/cpu-all.h | 7 +++++++ arch_init.c | 5 +++-- exec.c | 10 +++++----- 3 files changed, 15 insertions(+), 7 deletions(-) -- MST