Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Peter Maydell <peter.maydell@linaro.org>]

On Tue, 21 Apr 2020 at 11:22, Marc-André Lureau
<marcandre.lureau@gmail.com> wrote:
>
> Hi
>
> On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
> <philmd@redhat.com> wrote:
> >
> > Hi Samuel and Marc-André,
> >
> > Peter is going to tag 5.0-rc4 (final before release) today.
> > Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
> >
> > https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb
>
> libslirp is not following qemu release schedule.

From the upstream QEMU perspective, this seems to be a bit
of a pain point resulting from the separation of slirp out
into its own module. I do not like being blindsided by
random "oh hey there's a CVE fix but it's in some other
git repository and it's mixed in with a bunch of other
non-critical fixes" news on the day of releasing the
final release candidate :-(

While slirp remains a submodule that is the usual way
that QEMU is built, it would be really helpful if you could
ensure that the submodule works on a release schedule that
works with QEMU rather than against it...

thanks
-- PMM