[Debian] High CVE: CVE-2022-1050 qemu: a use-after-free condition

[Yue Tao]

CVE-2022-1050: https://nvd.nist.gov/vuln/detail/CVE-2022-1050

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

Base Score: High

Reference:

['qemu_1:5.2+dfsg-11+deb11u2_amd64.deb===>qemu_1:5.2+dfsg-11+deb11u3_amd64.deb', 'qemu-utils_1:5.2+dfsg-11+deb11u2_amd64.deb===>qemu-utils_1:5.2+dfsg-11+deb11u3_amd64.deb']

[Ghada Khalil (gkhalil)]

Changing the target release to stx.10.0 since the r/stx.9.0 release branch is created and the team doesn't port CVE fixes to released branches.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/virt/+/919664

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/virt/+/919664
Committed: https://opendev.org/starlingx/virt/commit/f7b1640f0b4b394c278bd64d13d343a149039644
Submitter: "Zuul (22348)"
Branch: master

commit f7b1640f0b4b394c278bd64d13d343a149039644
Author: Wentao Zhang <email address hidden>
Date: Tue May 14 01:54:18 2024 -0700

    Debian: qemu: fix CVE-2022-1050

    Upgrade qemu to 1:7.2+dfsg-7+deb12u5

    Refer to:
    https://security-tracker.debian.org/tracker/CVE-2022-1050

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2059901

    Change-Id: I13df6652dfa549ce876201b8053026117e72fd87
    Signed-off-by: Wentao Zhang <email address hidden>