SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Philippe Mathieu-Daudé]

Hi Samuel and Marc-André,

Peter is going to tag 5.0-rc4 (final before release) today.
Do you have plans to send a last minute pull-request to fix CVE-2020-1983?

https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb

Regards,

Phil.

Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Marc-André Lureau]

Hi

On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
<philmd@redhat.com> wrote:
>
> Hi Samuel and Marc-André,
>
> Peter is going to tag 5.0-rc4 (final before release) today.
> Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
>
> https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb

libslirp is not following qemu release schedule. The master branch has
a few changes that shouldn't be added to the release. We could create
version/stable/qemu branches, but then between each version, we would
end up with the submodule jumping between branches (with a non-linear
history). Is that the only option?

-- 
Marc-André Lureau

Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Daniel P. Berrangé]

On Tue, Apr 21, 2020 at 12:22:05PM +0200, Marc-André Lureau wrote:
> Hi
> 
> On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
> <philmd@redhat.com> wrote:
> >
> > Hi Samuel and Marc-André,
> >
> > Peter is going to tag 5.0-rc4 (final before release) today.
> > Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
> >
> > https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb
> 
> libslirp is not following qemu release schedule. The master branch has
> a few changes that shouldn't be added to the release. We could create
> version/stable/qemu branches, but then between each version, we would
> end up with the submodule jumping between branches (with a non-linear
> history). Is that the only option?

In the short term, it looks like a stable branch is the easiest option.

In the medium term, we need to more strongly push people to use the
distro provided slirp, or build it themselves, like they would have to
for (almost) any other 3rd party library we depend on. QEMU shouldn't
carry on doing the work of OS vendors indefinitely for slirp by having
to worry about updates to pull in CVE fixes from an external project.

I've got a few configure patches nearly ready to send to add such a
deprecation. It's been a year since QEMU switched Slirp to be a
submodule, and even longer since Slirp started as an independant
project. With some time allowed for the deprecation period, it will
be nearly 2 years before we finally remove Slirp from QEMU entirely.

Admittedly this may be troublesome for Debian which, AFAICT, does not
add new packages to pre-existing stable releases. Presumably someone
can add it to the "backports" release archive if this is too hard to
get into a stable release ? Failing that, users would have to build
slirp themselves.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Philippe Mathieu-Daudé]

On Tue, Apr 21, 2020 at 12:22 PM Marc-André Lureau
<marcandre.lureau@gmail.com> wrote:
>
> Hi
>
> On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
> <philmd@redhat.com> wrote:
> >
> > Hi Samuel and Marc-André,
> >
> > Peter is going to tag 5.0-rc4 (final before release) today.
> > Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
> >
> > https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb
>
> libslirp is not following qemu release schedule. The master branch has
> a few changes that shouldn't be added to the release. We could create
> version/stable/qemu branches, but then between each version, we would
> end up with the submodule jumping between branches (with a non-linear
> history). Is that the only option?

I'm not sure this is the only option, but thinking about the
qemu-stable release process, this sounds like a good option.
Stable tags are sterile leaves and don't get further development.

Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Peter Maydell]

On Tue, 21 Apr 2020 at 11:22, Marc-André Lureau
<marcandre.lureau@gmail.com> wrote:
>
> Hi
>
> On Tue, Apr 21, 2020 at 11:18 AM Philippe Mathieu-Daudé
> <philmd@redhat.com> wrote:
> >
> > Hi Samuel and Marc-André,
> >
> > Peter is going to tag 5.0-rc4 (final before release) today.
> > Do you have plans to send a last minute pull-request to fix CVE-2020-1983?
> >
> > https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb
>
> libslirp is not following qemu release schedule.

From the upstream QEMU perspective, this seems to be a bit
of a pain point resulting from the separation of slirp out
into its own module. I do not like being blindsided by
random "oh hey there's a CVE fix but it's in some other
git repository and it's mixed in with a bunch of other
non-critical fixes" news on the day of releasing the
final release candidate :-(

While slirp remains a submodule that is the usual way
that QEMU is built, it would be really helpful if you could
ensure that the submodule works on a release schedule that
works with QEMU rather than against it...

thanks
-- PMM

Re: SLiRP: use-afte-free in ip_reass() [CVE-2020-1983]

[Michael Tokarev]

21.04.2020 13:33, Daniel P. Berrangé wrote:
[]
> Admittedly this may be troublesome for Debian which, AFAICT, does not
> add new packages to pre-existing stable releases. Presumably someone
> can add it to the "backports" release archive if this is too hard to
> get into a stable release ? Failing that, users would have to build
> slirp themselves.

This wont be a problem for Debian really, exactly due to the reason you
mentioned - backports.  I'm backporting libslirp and current qemu right
now.

Thanks!

/mjt