* SECURITY UPDATE: fix to validate virtqueue in and out requests from the
guests
- debian/patches/CVE-2011-2212-virtqueue-indirect-overflow.patch: update
hw/virtio.c to verify the length of indirect descriptors in
virtqueue_pop() and virtqueue_avail_bytes()
- CVE-2011-2212
- LP: #806167
* SECURITY UPDATE: validate virtio_queue_notify() is non-negative
- virtio-guard-against-negative-vq-notifies-CVE-2011-2512.diff: update
to move comparison out to syborg_virtio_writel(), virtio_ioport_write()
and virtio_queue_notify_vq() and don't call common virtio code if
virtqueue number is invalid. Patch from Debian.
- CVE-2011-2512
- LP: #806166
-- Jamie Strandboge <email address hidden> Tue, 05 Jul 2011 13:24:52 -0500
This bug was fixed in the package qemu-kvm - 0.14.0+ noroms- 0ubuntu8
--------------- noroms- 0ubuntu8) oneiric; urgency=low
qemu-kvm (0.14.0+
* SECURITY UPDATE: fix to validate virtqueue in and out requests from the patches/ CVE-2011- 2212-virtqueue- indirect- overflow. patch: update _pop() and virtqueue_ avail_bytes( ) queue_notify( ) is non-negative guard-against- negative- vq-notifies- CVE-2011- 2512.diff: update virtio_ writel( ), virtio_ ioport_ write() queue_notify_ vq() and don't call common virtio code if
guests
- debian/
hw/virtio.c to verify the length of indirect descriptors in
virtqueue
- CVE-2011-2212
- LP: #806167
* SECURITY UPDATE: validate virtio_
- virtio-
to move comparison out to syborg_
and virtio_
virtqueue number is invalid. Patch from Debian.
- CVE-2011-2512
- LP: #806166
-- Jamie Strandboge <email address hidden> Tue, 05 Jul 2011 13:24:52 -0500