Qemu - possible Guest to Host CVE-2020-14364

[Sralityhe]

Hi Forum,

as some probably know there was a possible guest to host in qemu via usb with CVE-2020-14364 which affects all versions until 5.2 (which is not released).

A guest user may use this flaw to crash the QEMU process resulting in
DoS OR potentially execute arbitrary code with the privileges of the
QEMU process on the host.

May it be possible that we get a backport on this, since it seems like the version still needs some more time?
https://git.qemu.org/?p=qemu.git;a=commitdiff;h=b946434f2659a182afc17e155be6791ebfb302eb

Thanks!!

 

[Sralityhe]

*push*

Anybody from Proxmox Team mybe?

Edit: 5.1.0-2 seems to have to backports now,Thanks!

pve-qemu-kvm (5.1.0-2) pve; urgency=medium

* cherry-pick fix to harden checks for USB devices (CVE-2020-14364)