qemu: multiple security fixes

[l2dy]

• An assertion-failure flaw was found in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service. (CVE-2017-7539)

• Quick Emulator (QEMU) built with the Network Block Device (NBD) Server support is vulnerable to a crash via a SIGPIPE signal. The crash can occur if a client aborts a connection due to any failure during negotiation or read operation. A remote user/process could use this flaw to crash the qemu-nbd server resulting in a Denial of Service (DoS). (CVE-2017-10664)

• Quick Emulator (QEMU), compiled with qemu_map_ram_ptr to access guests' RAM block area, is vulnerable to an OOB r/w access issue. The crash can occur if a privileged user inside a guest conducts certain DMA operations, resulting in a DoS. (CVE-2017-11334)

• Quick emulator (QEMU), compiled with the Cirrus CLGD 54xx VGA Emulator support, is vulnerable to an OOB write access issue. The issue could occur while writing to VGA memory via mode4and5 write functions. A privileged user inside guest could use this flaw to crash the QEMU process resulting in Denial of Serivce (DoS). (CVE-2017-15289)

Ref: https://access.redhat.com/errata/RHSA-2017:3466

[MingcongBai]

CVE-2017-10664 is applied before 2.9.1.

[MingcongBai]

CVE-2017-7539 also applied before 2.9.1. And since none other patches that would apply to 2.10.* applied to 2.9.1, marking to-staging for this one as well.

[MingcongBai]

Don't assign an AOSA for this one before Nov-Dec Wave is made available.