On Mon, Mar 01, 2021 at 08:45:34PM +0300, Dmitry Baryshkov wrote: > On Mon, 1 Mar 2021 at 18:48, Greg Kroah-Hartman > <gregkh@xxxxxxxxxxxxxxxxxxx> wrote: > > > > On Mon, Mar 01, 2021 at 06:34:10PM +0300, Dmitry Baryshkov wrote: > > > On Sat, 13 Feb 2021 at 11:25, Greg Kroah-Hartman > > > <gregkh@xxxxxxxxxxxxxxxxxxx> wrote: > > > > > > > > On Fri, Feb 12, 2021 at 10:26:58PM +0300, Dmitry Baryshkov wrote: > > > > > Verify that user applications are not using the kernel RPC message > > > > > handle to restrict them from directly attaching to guest OS on the > > > > > remote subsystem. This is a port of CVE-2019-2308 fix. > > > > > > > > A port of the fix of what to what? > > > > > > I'm sorry for the confusion. It is a port of the original > > > Qualcomm/CodeAurora fix to the upstream driver. > > > > > > See https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=cc2e11eeb988964af72309f71b0fb21c11ed6ca9, > > > > So this is a fix from 2019 that you never submitted upstream causing all > > of these kernels to be vulnerable? > > It seems there is some kind of confusion here. > Srinivas and Thierry have developed the fastrpc driver. It is not the > same as the driver developed by Qualcomm. However in this case it > suffers from the same problem as the original adsprpc driver.. > We have submitted the fix as soon as we've noticed the issue. Ah, that makes more sense, thanks. So really, it's not the same CVE issue, aren't they fun? :) thanks, greg k-h
