[ Marc Deslauriers ]
* SECURITY UPDATE: heap overflow in floppy disk emulator
- debian/patches/CVE-2021-3507.patch: prevent end-of-track overrun in
hw/block/fdc.c.
- CVE-2021-3507
* SECURITY UPDATE: use-after-free in nvme
- debian/patches/CVE-2021-3929.patch: deny DMA to the iomem of the
device itself in hw/nvme/ctrl.c.
- CVE-2021-3929
* SECURITY UPDATE: integer overflow in QXL display device emulation
- debian/patches/CVE-2021-4206.patch: check width and height in
hw/display/qxl-render.c, hw/display/vmware_vga.c, ui/cursor.c.
- CVE-2021-4206
* SECURITY UPDATE: heap overflow in QXL display device emulation
- debian/patches/CVE-2021-4207.patch: fix race condition in qxl_cursor
in hw/display/qxl-render.c.
- CVE-2021-4207
* SECURITY UPDATE: potential privilege escalation in virtiofsd
- debian/patches/CVE-2022-0358.patch: Drop membership of all
supplementary groups in tools/virtiofsd/passthrough_ll.c.
- CVE-2022-0358
* SECURITY UPDATE: memory leakage in virtio-net device
- debian/patches/CVE-2022-26353.patch: fix map leaking on error during
receive in hw/net/virtio-net.c.
- CVE-2022-26353
* SECURITY UPDATE: memory leakage in vhost-vsock device
- debian/patches/CVE-2022-26354.patch: detach the virqueue element in
case of error in hw/virtio/vhost-vsock-common.c.
- CVE-2022-26354
[ Sergio Durigan Junior ]
* Fix I/O stalls when using NVMe storage (LP: #1970737).
- d/p/lp1970737-linux-aio-*.patch: Fix unbalanced plugged counter
in laio_io_unplug.
This bug was fixed in the package qemu - 1:6.2+dfsg-2ubuntu8
--------------- dfsg-2ubuntu8) kinetic; urgency=medium
qemu (1:6.2+
[ Marc Deslauriers ] patches/ CVE-2021- 3507.patch: prevent end-of-track overrun in block/fdc. c. patches/ CVE-2021- 3929.patch: deny DMA to the iomem of the patches/ CVE-2021- 4206.patch: check width and height in display/ qxl-render. c, hw/display/ vmware_ vga.c, ui/cursor.c. patches/ CVE-2021- 4207.patch: fix race condition in qxl_cursor qxl-render. c. patches/ CVE-2022- 0358.patch: Drop membership of all /passthrough_ ll.c. patches/ CVE-2022- 26353.patch: fix map leaking on error during virtio- net.c. patches/ CVE-2022- 26354.patch: detach the virqueue element in vhost-vsock- common. c.
* SECURITY UPDATE: heap overflow in floppy disk emulator
- debian/
hw/
- CVE-2021-3507
* SECURITY UPDATE: use-after-free in nvme
- debian/
device itself in hw/nvme/ctrl.c.
- CVE-2021-3929
* SECURITY UPDATE: integer overflow in QXL display device emulation
- debian/
hw/
- CVE-2021-4206
* SECURITY UPDATE: heap overflow in QXL display device emulation
- debian/
in hw/display/
- CVE-2021-4207
* SECURITY UPDATE: potential privilege escalation in virtiofsd
- debian/
supplementary groups in tools/virtiofsd
- CVE-2022-0358
* SECURITY UPDATE: memory leakage in virtio-net device
- debian/
receive in hw/net/
- CVE-2022-26353
* SECURITY UPDATE: memory leakage in vhost-vsock device
- debian/
case of error in hw/virtio/
- CVE-2022-26354
[ Sergio Durigan Junior ] linux-aio- *.patch: Fix unbalanced plugged counter
* Fix I/O stalls when using NVMe storage (LP: #1970737).
- d/p/lp1970737-
in laio_io_unplug.
-- Sergio Durigan Junior <email address hidden> Wed, 22 Jun 2022 15:38:37 -0400