diff --git a/SOURCES/kvm-qemu-nbd-Ignore-SIGPIPE.patch b/SOURCES/kvm-qemu-nbd-Ignore-SIGPIPE.patch new file mode 100644 index 0000000..346de1f --- /dev/null +++ b/SOURCES/kvm-qemu-nbd-Ignore-SIGPIPE.patch @@ -0,0 +1,67 @@ +From bf7e8348d0594026abf9b17356a935b31bf07274 Mon Sep 17 00:00:00 2001 +From: Eric Blake +Date: Mon, 10 Jul 2017 17:52:18 +0200 +Subject: [PATCH] qemu-nbd: Ignore SIGPIPE + +RH-Author: Eric Blake +Message-id: <20170710175218.13682-1-eblake@redhat.com> +Patchwork-id: 75718 +O-Subject: [RHEL-7.4.z qemu-kvm PATCH] qemu-nbd: Ignore SIGPIPE +Bugzilla: 1468107 +RH-Acked-by: John Snow +RH-Acked-by: Stefan Hajnoczi +RH-Acked-by: Paolo Bonzini + +From: Max Reitz + +qemu proper has done so for 13 years +(8a7ddc38a60648257dc0645ab4a05b33d6040063), qemu-img and qemu-io have +done so for four years (526eda14a68d5b3596be715505289b541288ef2a). +Ignoring this signal is especially important in qemu-nbd because +otherwise a client can easily take down the qemu-nbd server by dropping +the connection when the server wants to send something, for example: + +$ qemu-nbd -x foo -f raw -t null-co:// & +[1] 12726 +$ qemu-io -c quit nbd://localhost/bar +can't open device nbd://localhost/bar: No export with name 'bar' available +[1] + 12726 broken pipe qemu-nbd -x foo -f raw -t null-co:// + +In this case, the client sends an NBD_OPT_ABORT and closes the +connection (because it is not required to wait for a reply), but the +server replies with an NBD_REP_ACK (because it is required to reply). + +Signed-off-by: Max Reitz +Message-Id: <20170611123714.31292-1-mreitz@redhat.com> +Signed-off-by: Paolo Bonzini +(cherry picked from commit 041e32b8d9d076980b4e35317c0339e57ab888f1) +Signed-off-by: Miroslav Rezanina + +Conflicts: + qemu-nbd.c - context + +Fixes CVE-2017-10664 +Signed-off-by: Eric Blake +--- + qemu-nbd.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/qemu-nbd.c b/qemu-nbd.c +index e0f4517..fc768eb 100644 +--- a/qemu-nbd.c ++++ b/qemu-nbd.c +@@ -363,6 +363,11 @@ int main(int argc, char **argv) + memset(&sa_sigterm, 0, sizeof(sa_sigterm)); + sa_sigterm.sa_handler = termsig_handler; + sigaction(SIGTERM, &sa_sigterm, NULL); ++ ++#ifdef CONFIG_POSIX ++ signal(SIGPIPE, SIG_IGN); ++#endif ++ + qemu_init_exec_dir(argv[0]); + + while ((ch = getopt_long(argc, argv, sopt, lopt, &opt_ind)) != -1) { +-- +1.8.3.1 + diff --git a/SPECS/qemu-kvm.spec b/SPECS/qemu-kvm.spec index fc54cb1..ab70643 100644 --- a/SPECS/qemu-kvm.spec +++ b/SPECS/qemu-kvm.spec @@ -76,7 +76,7 @@ Obsoletes: %1 < %{obsoletes_version} \ Summary: QEMU is a machine emulator and virtualizer Name: %{pkgname}%{?pkgsuffix} Version: 1.5.3 -Release: 141%{?dist} +Release: 141%{?dist}.1 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped Epoch: 10 License: GPLv2+ and LGPLv2+ and BSD @@ -3594,6 +3594,8 @@ Patch1768: kvm-serial-reinstate-watch-after-migration.patch Patch1769: kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch # For bz#1451614 - CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4] Patch1770: kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch +# For bz#1468107 - CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z] +Patch1771: kvm-qemu-nbd-Ignore-SIGPIPE.patch BuildRequires: zlib-devel @@ -5542,6 +5544,7 @@ tar -xf %{SOURCE21} %patch1768 -p1 %patch1769 -p1 %patch1770 -p1 +%patch1771 -p1 %build buildarch="%{kvm_target}-softmmu" @@ -5987,6 +5990,11 @@ sh %{_sysconfdir}/sysconfig/modules/kvm.modules &> /dev/null || : %{_mandir}/man8/qemu-nbd.8* %changelog +* Tue Jul 11 2017 Miroslav Rezanina - 1.5.3-141.el7_4.1 +- kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107] +- Resolves: bz#1468107 + (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z]) + * Tue Jun 13 2017 Miroslav Rezanina - 1.5.3-141.el7 - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745] - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]