Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[20.03] qemu: patch CVE-2020-1711 #91093

Merged
merged 1 commit into from Jun 29, 2020

Conversation

@ckauhaus
Copy link
Contributor

ckauhaus commented Jun 19, 2020

Motivation for this change

This is a high profile risk identified in #88387 and a patch is readily available. So we should fix this one first.

No action required on nixos-unstable.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions Ubuntu
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests) qemu used in any test; ran tests/login.nix to verify
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
@ajs124
ajs124 approved these changes Jun 19, 2020
@ajs124
Copy link
Member

ajs124 commented Jun 19, 2020

Wrong branch? Shouldn't this go to release-20.03?

@risicle
Copy link
Contributor

risicle commented Jun 19, 2020

nix-review seems happy for me on macos 10.14, patch looks a-ok too

@ckauhaus
Copy link
Contributor Author

ckauhaus commented Jun 23, 2020

@ajs124 oops... rebasing

@ckauhaus ckauhaus force-pushed the ckauhaus:88387-fix-qemu-CVE-2020-1711 branch from 693bcd5 to f9fd435 Jun 23, 2020
@ckauhaus ckauhaus requested review from FRidh and jonringer as code owners Jun 23, 2020
@ckauhaus ckauhaus changed the base branch from nixos-20.03 to release-20.03 Jun 23, 2020
@ofborg ofborg bot added 6.topic: python and removed 6.topic: python labels Jun 23, 2020
@ckauhaus
Copy link
Contributor Author

ckauhaus commented Jun 23, 2020

another try :)

@dasJ
dasJ approved these changes Jun 28, 2020
@@ -84,6 +84,11 @@ stdenv.mkDerivation rec {
stripLen = 1;
extraPrefix = "slirp/";
})
(fetchpatch {

This comment has been minimized.

Copy link
@jonringer

jonringer Jun 28, 2020

Contributor

do you mind adding a reason, and timeline for removing the patch?

Suggested change
(fetchpatch {
# fixes x,y,z . Can be removed next minor/patch.
(fetchpatch {

This comment has been minimized.

Copy link
@jonringer

jonringer Jun 28, 2020

Contributor

i guess the patch name mentions the CVE

This comment has been minimized.

Copy link
@ckauhaus

ckauhaus Jul 3, 2020

Author Contributor

Oops, overlooked your comment. Patch will be obsolete in 4.2.1, just FTR.

@srhb srhb merged commit 17e83aa into NixOS:release-20.03 Jun 29, 2020
18 checks passed
18 checks passed
Evaluation Performance Report Evaluator Performance Report
Details
ansible, ansible.passthru.tests, chromedriver, chromedriver.passthru.tests, gitea, gitea.passthru.tests, qemu, qemu.passthru.tests, root5, root5.passthru.tests on aarch64-linux Success
Details
ansible, ansible.passthru.tests, chromedriver, chromedriver.passthru.tests, gitea, gitea.passthru.tests, qemu, qemu.passthru.tests, root5, root5.passthru.tests on x86_64-linux Success
Details
grahamcofborg-eval ^.^!
Details
grahamcofborg-eval-check-maintainers matching changed paths to changed attrs...
Details
grahamcofborg-eval-check-meta config.nix: checkMeta = true
Details
grahamcofborg-eval-darwin nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./pkgs/t
Details
grahamcofborg-eval-lib-tests nix-build --arg pkgs import ./. {} ./lib/tests/release.nix
Details
grahamcofborg-eval-nixos nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./nixos/
Details
grahamcofborg-eval-nixos-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./nixos/
Details
grahamcofborg-eval-nixos-options nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./nixos/
Details
grahamcofborg-eval-nixpkgs-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./pkgs/t
Details
grahamcofborg-eval-nixpkgs-tarball nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./pkgs/t
Details
grahamcofborg-eval-nixpkgs-unstable-jobset nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="f9fd435"; rev="f9fd435ad4e7df2bd7227161a2dffdae4fa6718c"; } ./pkgs/t
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
grahamcofborg-eval-package-list-no-aliases nix-env -qa --json --file . --arg config { allowAliases = false; }
Details
qemu, qemu.passthru.tests on aarch64-linux Success
Details
qemu, qemu.passthru.tests on x86_64-linux Success
Details
@ckauhaus ckauhaus deleted the ckauhaus:88387-fix-qemu-CVE-2020-1711 branch Jul 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

7 participants
You can’t perform that action at this time.