Patch qemu for CVE-2024-7409 [HIGH]

[kgodara912]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Addresses CVE-2024-7409 for qemu

Change Log

• Added patch for CVE-2024-7409 for qemu

Does this affect the toolchain?

NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2024-7409

Test Methodology

• Pipeline build id: 899879

[Kanishk-Bansal]

Patch Analysis (the patch applies cleanly w.r.t to upstream)
Failing Test : libguestfs is known failure.

• Buddy Build 
• patch applied during the build (check rpm.log)
• patch include an upstream reference
• PR has security tag

[kgodara912]

Buddy build, adding one more follow-up change for the CVE as pointed by @Kanishk-Bansal .

[PawelWMS]

@kgodara912: thank you for updating the patches, looks good. One request for the future: could I ask you to not rebase where you squish new commits with old ones? GitHub is only allowing to compare commits, so if you squish an update with an older commit, it's impossible to view the delta and makes reviewing harder. We end up squishing the whole PR anyway as we merge it, so even if a PR has many single commits, it doesn't create a mess in the base branch.

[PawelWMS]

PR looks good, waiting for the monthly release to be done before merging.

[kgodara912]

I haven't done extensive manual testing, but I have done minimal verification to avoid basic regression. I have verified booting of Azure Linux iso with qemu-system-x86_64 and it could boot the iso and installs the Azure Linux on qcow2 disk.