Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Apr 21, 2020 at 12:22:05PM +0200, Marc-André Lureau wrote:
> Hi
> 
> On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
> <philmd@redhat.com> wrote:
> >
> > Hi Samuel and Marc-André,
> >
> > Peter is going to tag 5.0-rc4 (final before release) today.
> > Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
> >
> > https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb
> 
> libslirp is not following qemu release schedule. The master branch has
> a few changes that shouldn't be added to the release. We could create
> version/stable/qemu branches, but then between each version, we would
> end up with the submodule jumping between branches (with a non-linear
> history). Is that the only option?

In the short term, it looks like a stable branch is the easiest option.

In the medium term, we need to more strongly push people to use the
distro provided slirp, or build it themselves, like they would have to
for (almost) any other 3rd party library we depend on. QEMU shouldn't
carry on doing the work of OS vendors indefinitely for slirp by having
to worry about updates to pull in CVE fixes from an external project.

I've got a few configure patches nearly ready to send to add such a
deprecation. It's been a year since QEMU switched Slirp to be a
submodule, and even longer since Slirp started as an independant
project. With some time allowed for the deprecation period, it will
be nearly 2 years before we finally remove Slirp from QEMU entirely.

Admittedly this may be troublesome for Debian which, AFAICT, does not
add new packages to pre-existing stable releases. Presumably someone
can add it to the "backports" release archive if this is too hard to
get into a stable release ? Failing that, users would have to build
slirp themselves.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|