> On Wednesday, 3 June 2015 4:33 PM, Markus Armbruster wrote:
> Let's go with Michael's v2, because it also fixes the "cleanup
> after mkdir() / mkdtemp() failed" scenario.
-> https://lists.nongnu.org/archive/html/qemu-devel/2015-06/msg00982.html
Ah yes, looks concise. Thank you.
---
Regard
P J P writes:
> Hello Markus,
>
>> On Monday, 1 June 2015 1:28 PM, Markus Armbruster wrote:
>> Michael (cc'ed) already posted "[PATCH] slirp: use less predictable
>> directory name in /tmp for smb config (CVE-2015-4037)"[*]. His patch
>> clobbers s->smb_dir[] when mkdtemp() fails (missed that
Hello Markus,
> On Monday, 1 June 2015 1:28 PM, Markus Armbruster wrote:
> Michael (cc'ed) already posted "[PATCH] slirp: use less predictable
> directory name in /tmp for smb config (CVE-2015-4037)"[*]. His patch
> clobbers s->smb_dir[] when mkdtemp() fails (missed that in my review),
> yours
01.06.2015 11:47, Paolo Bonzini пишет:
>
>
> On 01/06/2015 09:58, Markus Armbruster wrote:
-snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
- (long)getpid(), instance++);
-if (mkdir(s->smb_dir, 0700) < 0) {
-error_report("could not
On 01/06/2015 09:58, Markus Armbruster wrote:
>> > -snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
>> > - (long)getpid(), instance++);
>> > -if (mkdir(s->smb_dir, 0700) < 0) {
>> > -error_report("could not create samba server dir '%s'",
>> > s->smb_d
On Mon, Jun 01, 2015 at 09:58:10AM +0200, Markus Armbruster wrote:
> mreza...@redhat.com writes:
>
> > From: Miroslav Rezanina
> >
> > Qemu's user mode networking stack(-net user) is vulnerable to
> > a predictable temporary file creation flaw. This patch uses
> > mkdtemp(3) routine to fix it.
>
mreza...@redhat.com writes:
> From: Miroslav Rezanina
>
> Qemu's user mode networking stack(-net user) is vulnerable to
> a predictable temporary file creation flaw. This patch uses
> mkdtemp(3) routine to fix it.
>
> Fixes CVE-2015-4037.
>
> Signed-off-by: P J P
> Signed-off-by: Miroslav Rezani
From: Miroslav Rezanina
Qemu's user mode networking stack(-net user) is vulnerable to
a predictable temporary file creation flaw. This patch uses
mkdtemp(3) routine to fix it.
Fixes CVE-2015-4037.
Signed-off-by: P J P
Signed-off-by: Miroslav Rezanina
---
[1] http://seclists.org/oss-sec/2015/q
