Re: [Xen-devel] [PATCH v10 01/10] tools: Add vga=vmware

[Don Slutz <dslutz@xxxxxxxxxxx>]

On 05/15/15 04:49, Ian Campbell wrote:
> On Fri, 2015-05-15 at 00:42 +0100, Andrew Cooper wrote:
>> On 15/05/2015 00:34, Don Slutz wrote:
>>> This allows use of QEMU's VMware emulated video card
>>>
>>> Signed-off-by: Don Slutz <dslutz@xxxxxxxxxxx>
>>
>> Nack.
>>
>> Qemu-trad is currently has remote code execution vulnerabilities in its
>> vmware vga model.  CVE-2014-3689 amongst others.
> 
> Maybe we should only be exposing this new functionality with the
> qemu-upstream model?
> 
> In general we've not been taking new development to -trad for some time.
> 

I plan to go with the prevent usage of vga=vmware in
device_model_version=qemu-xen-traditional

   -Don Slutz

>>
>> Please fix those first before offering an option to configure it.
>>
>> ~Andrew
>>

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel