From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:39938)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1ZJhcJ-0001tN-9b
	for qemu-devel@nongnu.org; Mon, 27 Jul 2015 08:34:52 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jsnow@redhat.com>) id 1ZJhcF-0001ZZ-3o
	for qemu-devel@nongnu.org; Mon, 27 Jul 2015 08:34:51 -0400
Message-ID: <55B62565.9010404@redhat.com>
Date: Mon, 27 Jul 2015 08:34:45 -0400
From: John Snow <jsnow@redhat.com>
MIME-Version: 1.0
References: <1437998503-1865-1-git-send-email-jsnow@redhat.com>
	<55B61FC0.9000706@profihost.ag>
In-Reply-To: <55B61FC0.9000706@profihost.ag>
Content-Type: text/plain; charset=iso-8859-15
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [Qemu-stable] [PULL 0/3] Cve 2015 5154 patches
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Priebe - Profihost AG <s.priebe@profihost.ag>, qemu-devel@nongnu.org
Cc: peter.maydell@linaro.org, qemu-stable@nongnu.org



On 07/27/2015 08:10 AM, Stefan Priebe - Profihost AG wrote:
> 
> Am 27.07.2015 um 14:01 schrieb John Snow:
>> The following changes since commit f793d97e454a56d17e404004867985622ca1a63b:
>>
>>   Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2015-07-24 13:07:10 +0100)
>>
>> are available in the git repository at:
>>
>>   https://github.com/jnsnow/qemu.git tags/cve-2015-5154-pull-request
> 
> Any details on this CVE? Is RCE possible? Only if IDE is used?
> 
> Stefan
> 
>> for you to fetch changes up to cb72cba83021fa42719e73a5249c12096a4d1cfc:
>>
>>   ide: Clear DRQ after handling all expected accesses (2015-07-26 23:42:53 -0400)
>>
>> ----------------------------------------------------------------
>>
>> ----------------------------------------------------------------
>>
>> Kevin Wolf (3):
>>   ide: Check array bounds before writing to io_buffer (CVE-2015-5154)
>>   ide/atapi: Fix START STOP UNIT command completion
>>   ide: Clear DRQ after handling all expected accesses
>>
>>  hw/ide/atapi.c |  1 +
>>  hw/ide/core.c  | 32 ++++++++++++++++++++++++++++----
>>  2 files changed, 29 insertions(+), 4 deletions(-)
>>

See also http://seclists.org/oss-sec/2015/q3/212