new file mode 100644
@@ -0,0 +1,74 @@
+From 4851f8d4538e0a25992619ad96a2366c1632e46e Mon Sep 17 00:00:00 2001
+From: Michael Hanselmann <public@hansmi.ch>
+Date: Sun, 8 Aug 2021 15:35:58 +0200
+Subject: [PATCH] Avoid use-after-free in serialization
+
+Serializing parsers with large amounts of buffered write data (e.g. in case of
+a slow or blocked write destination) would cause "serialize_data" to reallocate
+the state buffer whose default size is 64kB (USBREDIRPARSER_SERIALIZE_BUF_SIZE).
+The pointer to the position for the write buffer count would then point to
+a location outside the buffer where the number of write buffers would be written
+as a 32-bit value.
+
+As of QEMU 5.2.0 the serializer is invoked for migrations. Serializations for
+migrations may happen regularily such as when using the COLO feature[1].
+Serialization happens under QEMU's I/O lock. The guest can't control the state
+while the serialization is happening. The value written is the number of
+outstanding buffers which would be suceptible to timing and host system system
+load. The guest would have to continously groom the write buffers. A useful
+value needs to be allocated in the exact position freed during the buffer size
+increase, but before the buffer count is written. The author doesn't consider it
+realistic to exploit this use-after-free reliably.
+
+[1] https://wiki.qemu.org/Features/COLO
+
+Signed-off-by: Michael Hanselmann <public@hansmi.ch>
+
+CVE: CVE-2021-3700
+Upstream-Status: Backport [https://gitlab.freedesktop.org/spice/usbredir/-/commit/03c519ff5831ba]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ usbredirparser/usbredirparser.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/usbredirparser/usbredirparser.c b/usbredirparser/usbredirparser.c
+index ba8edb4..ccd3078 100644
+--- a/usbredirparser/usbredirparser.c
++++ b/usbredirparser/usbredirparser.c
+@@ -20,6 +20,7 @@
+ */
+ #include "config.h"
+
++#include <stddef.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <stdarg.h>
+@@ -1594,8 +1595,9 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
+ struct usbredirparser_priv *parser =
+ (struct usbredirparser_priv *)parser_pub;
+ struct usbredirparser_buf *wbuf;
+- uint8_t *write_buf_count_pos, *state = NULL, *pos = NULL;
++ uint8_t *state = NULL, *pos = NULL;
+ uint32_t write_buf_count = 0, len, remain = 0;
++ ptrdiff_t write_buf_count_pos;
+
+ *state_dest = NULL;
+ *state_len = 0;
+@@ -1640,7 +1642,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
+ parser->data, parser->data_read, "packet-data"))
+ return -1;
+
+- write_buf_count_pos = pos;
++ write_buf_count_pos = pos - state;
+ /* To be replaced with write_buf_count later */
+ if (serialize_int(parser, &state, &pos, &remain, 0, "write_buf_count"))
+ return -1;
+@@ -1655,7 +1657,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
+ wbuf = wbuf->next;
+ }
+ /* Patch in write_buf_count */
+- memcpy(write_buf_count_pos, &write_buf_count, sizeof(int32_t));
++ memcpy(state + write_buf_count_pos, &write_buf_count, sizeof(int32_t));
+
+ /* Patch in length */
+ len = pos - state;
@@ -9,7 +9,9 @@ DEPENDS = "libusb1"
SRCREV = "bca484fc6f206ab9da2f73e8a0118fad45374d4e"
-SRC_URI = "git://gitlab.freedesktop.org/spice/usbredir;branch=main;protocol=https"
+SRC_URI = "git://gitlab.freedesktop.org/spice/usbredir;branch=main;protocol=https \
+ file://CVE-2021-3700.patch \
+ "
S = "${WORKDIR}/git"
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3700 Pick the patch mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> --- .../spice/usbredir/CVE-2021-3700.patch | 74 +++++++++++++++++++ .../recipes-support/spice/usbredir_0.9.0.bb | 4 +- 2 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/spice/usbredir/CVE-2021-3700.patch