diff options
| author | Mauro Matteo Cascella <mcascell@redhat.com> | 2022-07-11 14:33:16 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2022-07-13 16:58:57 +0200 |
| commit | 4367a20cc442c56b05611b4224de9a61908f9eac (patch) | |
| tree | f2bfd3dbeecd71996175f44fa1c01de8f55e58ad /python | |
| parent | 8e3d85d36b77f11ad7bded3a2d48c1f0cc334f82 (diff) | |
| download | focaccia-qemu-4367a20cc442c56b05611b4224de9a61908f9eac.tar.gz focaccia-qemu-4367a20cc442c56b05611b4224de9a61908f9eac.zip | |
scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)
Set current_req to NULL, not current_req->req, to prevent reusing a free'd buffer in case of repeated SCSI cancel requests. Also apply the fix to CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel the request. Thanks to Alexander Bulekov for providing a reproducer. Fixes: CVE-2022-0216 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20220711123316.421279-1-mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'python')
0 files changed, 0 insertions, 0 deletions