From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42938) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZbY6x-0000pR-To for qemu-devel@nongnu.org; Mon, 14 Sep 2015 14:04:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZbY6x-0003a7-2i for qemu-devel@nongnu.org; Mon, 14 Sep 2015 14:04:15 -0400 References: <1441816082-21031-1-git-send-email-jsnow@redhat.com> <55F27B1D.4030901@msgid.tls.msk.ru> From: John Snow Message-ID: <55F70C16.1070302@redhat.com> Date: Mon, 14 Sep 2015 14:04:06 -0400 MIME-Version: 1.0 In-Reply-To: <55F27B1D.4030901@msgid.tls.msk.ru> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] ide: fix ATAPI command permissions List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Michael Tokarev , qemu-block@nongnu.org Cc: kwolf@redhat.com, stefano.stabellini@eu.citrix.com, armbru@redhat.com, qemu-devel@nongnu.org, ppandit@redhat.com, luodalongde@gmail.com, liuling-it@360.cn On 09/11/2015 02:56 AM, Michael Tokarev wrote: > 09.09.2015 19:28, John Snow wrote: >> We're a little too lenient with what we'll let an ATAPI drive handle. >> Clamp down on the IDE command execution table to remove CD_OK permissions >> from commands that are not and have never been ATAPI commands. > > FWIW, this issue has been assigned CVE-2015-6855 identifier, which > can be reflected in the commit message when applying. Since this > issue has security impact, it might be a good idea to add > > Cc: qemu-stable@nongnu.org > > Thanks, > > /mjt > I'm still awaiting review/acks, but would you like me to re-send this patch to trivial, or just fwd/reply-to? Thanks, --js